CyberSecurity news

FlagThis - #blackbasta

@detect.fyi //

Black Basta Ransomware Operations Continue - The Black Basta ransomware group remains active despite a data leak, using advanced techniques and demonstrating adaptability in their attacks.
References: detect.fyi , medium.com , wazuh.com ...
The Black Basta ransomware group has demonstrated remarkable resilience and adaptability despite a significant leak of their internal communications, which occurred in the first quarter of 2025. Analysis of the leaked chat logs confirms that key actors within the group, operating under aliases like @usernamegg, @lapa, and @usernameugway, continue to coordinate attacks using shared infrastructure and custom tools. This indicates a high level of operational security and a focus on long-term planning, as the group rotates delivery domains, stages different botnets for specific functions, and carefully avoids detection through staggered attack timing and limited-volume delivery. The group's persistence highlights the challenges faced by defenders in disrupting sophisticated cybercrime enterprises.

Their tactics, techniques, and procedures (TTPs) align closely with those attributed by Microsoft to groups like Storm-1674, Storm-1811, and Storm-2410. These include exploiting vulnerabilities in Citrix and VPN portals, targeting weak authentication on ESXi hypervisors, employing credential stuffing attacks, and leveraging remote access utilities and scripts for payload delivery. Black Basta has also shown an increasing emphasis on social engineering, such as impersonating IT support staff via phone calls, mirroring techniques associated with Storm-2410. This adaptability and willingness to evolve their attack methods underscore the group's sophistication.

Black Basta's operations involve a multi-stage attack chain, starting with initial access gained through various methods, including exploiting vulnerabilities in unpatched systems, phishing campaigns, and social engineering tactics such as impersonating IT help desks via Microsoft Teams. The group also employs lightweight downloaders, memory-based loaders, and obfuscated commands via tools like PowerShell and rundll32.exe, indicating a shift toward stealthier and more precise attack delivery. Detection methods for Black Basta include configuring Endpoint Detection and Response (EDR) tools to look for unusual file behavior, command-line activity, registry changes, and network traffic.

Recommended read:
References :
  • detect.fyi: Analysis of Black Basta's ransomware resilience and evolution after a data leak.
  • medium.com: Information on Black Basta's use of lightweight downloaders, memory-based loaders, and obfuscated commands.
  • valhalla.nextron-systems.com: Report on Black Basta's ransomware operations.
  • wazuh.com: Analysis of the leaked Black Basta chat logs revealing their operational methods.
Bill Toulas@BleepingComputer //

Black Basta's BRUTED Framework Automates VPN Brute-Force Attacks - The Black Basta ransomware operation has developed 'BRUTED,' an automated brute-forcing framework, to breach edge networking devices and gain unauthorized network access, potentially leading to ransomware deployment and data theft.
The Black Basta ransomware operation has developed a new automated brute-forcing framework called 'BRUTED' to compromise edge networking devices such as firewalls and VPNs. This framework is designed to automate the process of gaining unauthorized access to sensitive networks, which can lead to ransomware deployment and data theft. Security experts warn that this new tool empowers attackers to more efficiently breach enterprise VPNs and firewalls, marking a worrying escalation in ransomware tactics.

EclecticIQ analysts, after analyzing the source code, confirmed the primary capability of the tool is the automated internet scanning and credential stuffing against edge network devices. This framework targets widely used firewalls and VPN solutions in corporate networks. This tool is able to exploit weak or reused credentials, gaining an initial foothold for lateral movement and ransomware deployment.

Recommended read:
References :
  • KubikPixel: Ransomware gang creates tool to automate VPN brute-force attacks The Black Basta ransomware operation created an automated brute-forcing framework dubbed 'BRUTED' to breach edge networking devices like firewalls and VPNs. ğŸŒ�
  • The DefendOps Diaries: Explore the BRUTED framework, a new tool by Black Basta, automating brute-force attacks on VPNs, posing a global threat to organizations.
  • Davey Winder: Hackers now have the tools to automate brute force attacks of your VPNs and firewalls during ransomware campaigns.
  • Talkback Resources: Inside BRUTED: Black Basta (RaaS) Members Used Automated Brute Forcing Framework to Target Edge Network Devices [net] [mal]
  • BleepingComputer: Ransomware gang creates tool to automate VPN brute-force attacks
  • bsky.app: The Black Basta ransomware operation created an automated brute-forcing framework dubbed 'BRUTED' to breach edge networking devices like firewalls and VPNs. https://www.bleepingcomputer.com/news/security/black-basta-ransomware-creates-automated-tool-to-brute-force-vpns/
  • bsky.app: The Black Basta ransomware operation created an automated brute-forcing framework dubbed 'BRUTED' to breach edge networking devices like firewalls and VPNs.
  • bsky.app: The BlackBasta ransomware gang developed and used its own custom tool to brute-force enterprise firewalls and VPN remote-access products.
  • www.techradar.com: Infamous ransomware hackers reveal new tool to brute-force VPNs
  • www.cybersecuritydive.com: Black Basta uses brute-forcing tool to attack edge devices
  • www.scworld.com: Automated brute forcing tool leveraged in Black Basta ransomware intrusions
  • www.cysecurity.news: Ransomware gang creates tool to automate VPN brute-force attacks The Black Basta ransomware operation created an automated brute-forcing framework dubbed 'BRUTED' to breach edge networking devices like firewalls and VPNs.
securebulletin.com@Secure Bulletin //

Cactus Ransomware Tactics Linked to Former Black Basta Affiliates - Research uncovers links between Black Basta and Cactus ransomware gangs, with both utilizing similar social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.
New research indicates a connection between the Black Basta and Cactus ransomware gangs, with both groups employing similar social engineering attacks and the BackConnect proxy malware to gain persistent access to corporate networks. Trend Micro researchers have highlighted how both ransomware groups utilize the BackConnect (BC) module to maintain control over infected hosts and exfiltrate sensitive data. The use of QBACKCONNECT suggests a close working relationship between Black Basta and the QakBot developers.

The BackConnect module, tracked as QBACKCONNECT due to its overlaps with the QakBot loader, grants attackers a wide range of remote control capabilities. This allows them to execute commands, steal sensitive data, such as login credentials, financial information, and personal files. Researchers observed a CACTUS ransomware attack that mirrored Black Basta's methods in deploying BackConnect, but extended their operations to include lateral movement and data exfiltration.

Recommended read:
References :
  • The Hacker News: Researchers Link CACTUS Ransomware Tactics to Former Black Basta Affiliates
  • www.bleepingcomputer.com: Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware
  • Virus Bulletin: Trend Micro researchers discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.
  • bsky.app: New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.
  • Secure Bulletin: Black Basta and CACTUS ransomware: shared BackConnect module signals affiliate transition
  • BleepingComputer: New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.
  • Virus Bulletin: Trend Micro researchers discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.
Dissent@DataBreaches.Net //

Black Basta Chats Leaked Revealing Cybercrime Tactics - Leaked internal chat communications of the Black Basta ransomware group reveal cybercriminals' operations, attack planning, and evasion techniques, highlighting their exploits and security measures bypassed.
Leaked internal chat logs from the Black Basta ransomware group have provided unprecedented insight into the tactics, planning, and operational methods of cybercriminals. The Veriti Research team analyzed these communications, uncovering the group's favored exploits, the security measures they routinely bypass, and the defenses they fear most. The leak, rivals that of the Conti ransomware gang, exposes Black Basta's meticulous study of potential victims and their sophisticated phishing and malware campaigns.

The analysis reveals Black Basta's focus on exploiting vulnerabilities in VMware ESXi, Microsoft Exchange, Citrix VPNs, and Fortinet firewalls. They actively discuss bypassing EDR, SIEM, and firewall protections to maintain persistence within compromised networks, leveraging cloud services for malware hosting and command-and-control infrastructure. Despite their skills, Black Basta members express frustration when EDRs, firewalls, and IP reputation monitoring disrupt their operations. A key member of Black Basta contended they had been able to elude law enforcement in mid-2024 with help from influential people.

Recommended read:
References :
  • VERITI: Inside the Minds of Cybercriminals: A Deep Dive into Black Basta’s Leaked Chats
  • DataBreaches.Net: Black Basta exposed: A look at a cybercrime data leak and a key member, “Trampâ€�
  • www.csoonline.com: Ransomware access playbook: What Black Basta’s leaked logs reveal
  • Information Security Buzz: VulnCheck Exposes CVEs from Black Bastas’ Chats
  • Risky Business Media: Risky Business Talks interview with Will Thomas on the Black Basta leaks
  • bsky.app: New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.
  • Virus Bulletin: Trend Micro researchers discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.
  • www.bleepingcomputer.com: Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware
  • Secure Bulletin: Black Basta and CACTUS ransomware: shared BackConnect module signals affiliate transition
  • flare.io: On February 20, 2025, the cybersecurity community received an unexpected stroke of luck as internal strife seemingly spread within the infamous Black Basta ransomware group.
BushidoToken (noreply@blogger.com)@blog.bushidotoken.net //

BlackBasta Leaks Reveal Details of Ascension Health Attack - BlackBasta ransomware gang's attack on Ascension Health involved exfiltration of 1.4TB of data, encryption of over 12,000 servers, and initial access gained via phishing and password guessing months before ransomware deployment.
BlackBasta ransomware group's attack on Ascension Health, one of the largest healthcare providers in the US, has been brought to light by leaked chat logs. The incident, which occurred in May 2024, significantly disrupted services and involved the exfiltration of 1.4TB of data and encryption of over 12,000 servers. The BlackBasta gang gained initial access months prior to deploying the ransomware, starting around November 2023, using phishing and password guessing techniques to compromise 14 email addresses of Ascension Health employees.

These leaked chat logs provide researchers a unique opportunity to understand the inner workings of the Russia-based cybercrime enterprise. The BlackBasta gang, consisting of former Conti ransomware members, exhibits similar operational structures. Veriti Research analyzed the leaked communications, revealing that BlackBasta exploited vulnerabilities in VMware ESXi, Microsoft Exchange, Citrix VPNs, and Fortinet firewalls, and Active Directory. The gang also uses cloud services for malware hosting and adjusts tactics to evade detection, while expressing frustration when EDRs, firewalls, and IP reputation monitoring disrupt their operations.

Recommended read:
References :
  • blog.bushidotoken.net: BlackBasta Leaks: Lessons from the Ascension Health attack
  • thecyberexpress.com: Black Basta Chat Logs Reveal Ransomware Group’s TTPs, IoCs
  • VERITI: Inside the Minds of Cybercriminals: A Deep Dive into Black Basta’s Leaked Chats
  • aboutdfir.com: Report on the attack on Ascension Health and the alleged involvement of Black Basta.
  • ASEC: Description of the ransomware attack, its impact, and the potential ramifications for healthcare organizations.
@www.the420.in //

Black Basta Ransomware Gang Internal Chats Leaked - Internal chat logs of the Black Basta ransomware gang have been leaked, exposing internal strife, financial disputes, and operations details.
A significant leak of internal chat logs from the Black Basta ransomware gang has surfaced online, exposing the group's inner workings. TechCrunch obtained a copy of the chat logs, which reveal internal strife, financial disputes, and operational details spanning from September 2023 to September 2024. The exposed communications shed light on the gang's key members, targeted organizations, exploits, and even their fears of government intervention, with one leaker alleging the group "crossed the line" by targeting Russian domestic banks.

The leaked chat logs provide insights into Black Basta's structure, including administrators and hackers linked to the Qakbot botnet. One member, known as "Trump" or "AA" and "GG," is believed to be Oleg Nefedovaka, potentially the group's main boss with connections to the defunct Conti ransomware group. The leak has also exposed Black Basta's phishing templates, victim credentials, and cryptocurrency addresses. The exposure of this sensitive information could significantly disrupt the gang's operations and assist cybersecurity professionals in understanding and mitigating Black Basta's tactics.

Recommended read:
References :
  • techcrunch.com: A huge trove of chat logs from the Black Basta ransomware gang have leaked online. TechCrunch obtained a copy.
  • cyberinsider.com: A major leak of internal chat logs from the Black Basta ransomware gang has exposed deep internal conflicts, failed operations, and financial disputes.
  • www.scworld.com: Purported Black Basta internal communications exposed
  • www.the420.in: A massive leak of internal chat logs from the BlackBasta ransomware group has exposed the inner workings of the notorious cybercriminal organization, revealing internal conflicts, financial disputes, and the group’s eventual disbanding.
  • Zack Whittaker: New, w/ : A huge trove of chat logs from the Black Basta ransomware gang have leaked online. TechCrunch obtained a copy. The logs reveal new details on the group's members (including a 17-year-old), which organizations it targeted, their exploits, and their fears of being vanned by the Russian government. More:
  • socradar.io: Black Basta’s Internal Chats Leak: Everything You Need to Know
  • CyberInsider: Black Basta Ransomware Chats Leaked Exposing Internal Chaos
  • threatmon.io: The Implosion of Black Basta: A Deep Dive into the Leaked Chat Logs and Operational Collapse The recent leak of internal chat logs from the Black Basta ransomware syndicate has provided unprecedented visibility into the operations, conflicts, and eventual disintegration of one of the most prolific cybercriminal groups of the past three years.
  • Blog: New Details on Black Basta Operations via Leaked Chats on Telegram
  • ThreatMon: The Implosion of Black Basta: A Deep Dive into the Leaked Chat Logs and Operational Collapse
  • Carly Page: A trove of chat logs allegedly belonging to the prolific Black Basta ransomware group has leaked online, revealing unprecedented insights into the gang's operations The logs, seen by TechCrunch, also name several previously unknown targeted organizations
  • bsky.app: Article reporting on the leak of Black Basta ransomware gang's internal chat logs.
  • www.bleepingcomputer.com: Article on the Black Basta ransomware gang's internal chat logs leak.
  • BleepingComputer: The article reports on the leak of internal communications from the Black Basta ransomware group.
  • arstechnica.com: Report sheds new light on the tactics allowing Black Basta and other attackers to move at breakneck speed.
  • mastodon.social: A significant leak of internal chat logs from the Black Basta ransomware group revealed significant operational details.
  • securityaffairs.com: Leaked Black Basta chat logs reveal internal conflicts, exposing member details and hacking tools as the gang reportedly falls apart.
  • Kali Linux Tutorials: BlackBasta Chat : The Inner Workings Of A Notorious Ransomware Group
  • socradar.io: Seraph Stealer Malware Hits the Market, Black Basta’s Internal Chaos, New Data Leak Claims
  • thecyberexpress.com: Black Basta Chat Logs Reveal Ransomware Group’s TTPs, IoCs
  • DataBreaches.Net: DataBreaches.net reporting Black Basta exposed: A look at a cybercrime data leak and a key member, “Trampâ€�.
  • blog.bushidotoken.net: BushidoToken analysis of BlackBasta Leaks: Lessons from the Ascension Health attack
  • VERITI: Veriti's analysis of Black Basta's Leaked Chats.

Posts

Blogs

Research Tools