CyberSecurity news

FlagThis - #blackbasta

Dissent@DataBreaches.Net //

Black Basta Chats Leaked Revealing Cybercrime Tactics - Leaked internal chat communications of the Black Basta ransomware group reveal cybercriminals' operations, attack planning, and evasion techniques, highlighting their exploits and security measures bypassed.
Leaked internal chat logs from the Black Basta ransomware group have provided unprecedented insight into the tactics, planning, and operational methods of cybercriminals. The Veriti Research team analyzed these communications, uncovering the group's favored exploits, the security measures they routinely bypass, and the defenses they fear most. The leak, rivals that of the Conti ransomware gang, exposes Black Basta's meticulous study of potential victims and their sophisticated phishing and malware campaigns.

The analysis reveals Black Basta's focus on exploiting vulnerabilities in VMware ESXi, Microsoft Exchange, Citrix VPNs, and Fortinet firewalls. They actively discuss bypassing EDR, SIEM, and firewall protections to maintain persistence within compromised networks, leveraging cloud services for malware hosting and command-and-control infrastructure. Despite their skills, Black Basta members express frustration when EDRs, firewalls, and IP reputation monitoring disrupt their operations. A key member of Black Basta contended they had been able to elude law enforcement in mid-2024 with help from influential people.

Recommended read:
References :
  • VERITI: Inside the Minds of Cybercriminals: A Deep Dive into Black Basta’s Leaked Chats
  • DataBreaches.Net: Black Basta exposed: A look at a cybercrime data leak and a key member, “Trampâ€�
  • www.csoonline.com: Ransomware access playbook: What Black Basta’s leaked logs reveal
  • Information Security Buzz: VulnCheck Exposes CVEs from Black Bastas’ Chats
  • Risky Business: Risky Business Talks interview with Will Thomas on the Black Basta leaks
  • bsky.app: New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.
  • Virus Bulletin: Trend Micro researchers discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.
  • www.bleepingcomputer.com: Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware
  • Secure Bulletin: Black Basta and CACTUS ransomware: shared BackConnect module signals affiliate transition
  • flare.io: On February 20, 2025, the cybersecurity community received an unexpected stroke of luck as internal strife seemingly spread within the infamous Black Basta ransomware group.
@www.the420.in //

Black Basta Ransomware Gang Internal Chats Leaked - Internal chat logs of the Black Basta ransomware gang have been leaked, exposing internal strife, financial disputes, and operations details.
A significant leak of internal chat logs from the Black Basta ransomware gang has surfaced online, exposing the group's inner workings. TechCrunch obtained a copy of the chat logs, which reveal internal strife, financial disputes, and operational details spanning from September 2023 to September 2024. The exposed communications shed light on the gang's key members, targeted organizations, exploits, and even their fears of government intervention, with one leaker alleging the group "crossed the line" by targeting Russian domestic banks.

The leaked chat logs provide insights into Black Basta's structure, including administrators and hackers linked to the Qakbot botnet. One member, known as "Trump" or "AA" and "GG," is believed to be Oleg Nefedovaka, potentially the group's main boss with connections to the defunct Conti ransomware group. The leak has also exposed Black Basta's phishing templates, victim credentials, and cryptocurrency addresses. The exposure of this sensitive information could significantly disrupt the gang's operations and assist cybersecurity professionals in understanding and mitigating Black Basta's tactics.

Recommended read:
References :
  • techcrunch.com: A huge trove of chat logs from the Black Basta ransomware gang have leaked online. TechCrunch obtained a copy.
  • cyberinsider.com: A major leak of internal chat logs from the Black Basta ransomware gang has exposed deep internal conflicts, failed operations, and financial disputes.
  • www.scworld.com: Purported Black Basta internal communications exposed
  • www.the420.in: A massive leak of internal chat logs from the BlackBasta ransomware group has exposed the inner workings of the notorious cybercriminal organization, revealing internal conflicts, financial disputes, and the group’s eventual disbanding.
  • Zack Whittaker: New, w/ : A huge trove of chat logs from the Black Basta ransomware gang have leaked online. TechCrunch obtained a copy. The logs reveal new details on the group's members (including a 17-year-old), which organizations it targeted, their exploits, and their fears of being vanned by the Russian government. More:
  • socradar.io: Black Basta’s Internal Chats Leak: Everything You Need to Know
  • CyberInsider: Black Basta Ransomware Chats Leaked Exposing Internal Chaos
  • threatmon.io: The Implosion of Black Basta: A Deep Dive into the Leaked Chat Logs and Operational Collapse The recent leak of internal chat logs from the Black Basta ransomware syndicate has provided unprecedented visibility into the operations, conflicts, and eventual disintegration of one of the most prolific cybercriminal groups of the past three years.
  • Blog: New Details on Black Basta Operations via Leaked Chats on Telegram
  • ThreatMon: The Implosion of Black Basta: A Deep Dive into the Leaked Chat Logs and Operational Collapse
  • Carly Page: A trove of chat logs allegedly belonging to the prolific Black Basta ransomware group has leaked online, revealing unprecedented insights into the gang's operations The logs, seen by TechCrunch, also name several previously unknown targeted organizations
  • bsky.app: Article reporting on the leak of Black Basta ransomware gang's internal chat logs.
  • www.bleepingcomputer.com: Article on the Black Basta ransomware gang's internal chat logs leak.
  • BleepingComputer: The article reports on the leak of internal communications from the Black Basta ransomware group.
  • arstechnica.com: Report sheds new light on the tactics allowing Black Basta and other attackers to move at breakneck speed.
  • mastodon.social: A significant leak of internal chat logs from the Black Basta ransomware group revealed significant operational details.
  • securityaffairs.com: Leaked Black Basta chat logs reveal internal conflicts, exposing member details and hacking tools as the gang reportedly falls apart.
  • Kali Linux Tutorials: BlackBasta Chat : The Inner Workings Of A Notorious Ransomware Group
  • socradar.io: Seraph Stealer Malware Hits the Market, Black Basta’s Internal Chaos, New Data Leak Claims
  • thecyberexpress.com: Black Basta Chat Logs Reveal Ransomware Group’s TTPs, IoCs
  • DataBreaches.Net: DataBreaches.net reporting Black Basta exposed: A look at a cybercrime data leak and a key member, “Trampâ€�.
  • blog.bushidotoken.net: BushidoToken analysis of BlackBasta Leaks: Lessons from the Ascension Health attack
  • VERITI: Veriti's analysis of Black Basta's Leaked Chats.
securebulletin.com@Secure Bulletin //

Cactus Ransomware Tactics Linked to Former Black Basta Affiliates - Research uncovers links between Black Basta and Cactus ransomware gangs, with both utilizing similar social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.
New research indicates a connection between the Black Basta and Cactus ransomware gangs, with both groups employing similar social engineering attacks and the BackConnect proxy malware to gain persistent access to corporate networks. Trend Micro researchers have highlighted how both ransomware groups utilize the BackConnect (BC) module to maintain control over infected hosts and exfiltrate sensitive data. The use of QBACKCONNECT suggests a close working relationship between Black Basta and the QakBot developers.

The BackConnect module, tracked as QBACKCONNECT due to its overlaps with the QakBot loader, grants attackers a wide range of remote control capabilities. This allows them to execute commands, steal sensitive data, such as login credentials, financial information, and personal files. Researchers observed a CACTUS ransomware attack that mirrored Black Basta's methods in deploying BackConnect, but extended their operations to include lateral movement and data exfiltration.

Recommended read:
References :
  • The Hacker News: Researchers Link CACTUS Ransomware Tactics to Former Black Basta Affiliates
  • www.bleepingcomputer.com: Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware
  • Virus Bulletin: Trend Micro researchers discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.
  • bsky.app: New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.
  • Secure Bulletin: Black Basta and CACTUS ransomware: shared BackConnect module signals affiliate transition
  • BleepingComputer: New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.
  • Virus Bulletin: Trend Micro researchers discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.
Amar Ćemanović@CyberInsider //

Ascension Health Ransomware Exposes 5.6 Million Records - Ascension Health experienced a ransomware attack by Black Basta, exposing the data of 5.6 million patients and disrupting operations across 140 hospitals.
Ascension Health, a major healthcare provider, has confirmed a significant data breach impacting 5.6 million patients following a ransomware attack in May. The attack, attributed to the Black Basta ransomware group, involved the exfiltration of sensitive data including medical records, financial details, insurance information and government IDs, alongside personal identifiers. The cyber incident caused considerable disruption across Ascension's 140 hospitals, impacting critical operations. The breach was discovered May 8th after unauthorized access to systems in February and is considered one of the largest healthcare data breaches of the year.

The exposed data included a variety of sensitive information, including medical record numbers, dates of service, and payment details like credit card and bank account information. Also exposed were Social Security numbers, driver's license numbers, and passport details. While patient data was compromised, the core Electronic Health Records system was not affected. Ascension is offering affected individuals 24 months of credit and CyberScan monitoring, along with a $1,000,000 insurance reimbursement policy and ID theft recovery services.

Recommended read:
References :
  • CyberInsider: Ascension Health Ransomware Attack Exposes Data of 5.5 Million People
  • Zack Whittaker: Hospital giant Ascension said a May ransomware attack allowed hackers to steal data on 5.6 million patients
  • Osint10x: Nearly 6 million people were impacted by ransomware attack on Ascension Health
  • techcrunch.com: Ransomware attack on health giant Ascension hits 5.6 million patients
  • bsky.app: ​Ascension, one of the largest private U.S. healthcare systems, is notifying over 5.6 million patients and employees that their personal and health data was stolen in a May cyberattack linked to the Black Basta ransomware operation.
BushidoToken (noreply@blogger.com)@blog.bushidotoken.net //

BlackBasta Leaks Reveal Details of Ascension Health Attack - BlackBasta ransomware gang's attack on Ascension Health involved exfiltration of 1.4TB of data, encryption of over 12,000 servers, and initial access gained via phishing and password guessing months before ransomware deployment.
BlackBasta ransomware group's attack on Ascension Health, one of the largest healthcare providers in the US, has been brought to light by leaked chat logs. The incident, which occurred in May 2024, significantly disrupted services and involved the exfiltration of 1.4TB of data and encryption of over 12,000 servers. The BlackBasta gang gained initial access months prior to deploying the ransomware, starting around November 2023, using phishing and password guessing techniques to compromise 14 email addresses of Ascension Health employees.

These leaked chat logs provide researchers a unique opportunity to understand the inner workings of the Russia-based cybercrime enterprise. The BlackBasta gang, consisting of former Conti ransomware members, exhibits similar operational structures. Veriti Research analyzed the leaked communications, revealing that BlackBasta exploited vulnerabilities in VMware ESXi, Microsoft Exchange, Citrix VPNs, and Fortinet firewalls, and Active Directory. The gang also uses cloud services for malware hosting and adjusts tactics to evade detection, while expressing frustration when EDRs, firewalls, and IP reputation monitoring disrupt their operations.

Recommended read:
References :
  • blog.bushidotoken.net: BlackBasta Leaks: Lessons from the Ascension Health attack
  • thecyberexpress.com: Black Basta Chat Logs Reveal Ransomware Group’s TTPs, IoCs
  • VERITI: Inside the Minds of Cybercriminals: A Deep Dive into Black Basta’s Leaked Chats
  • aboutdfir.com: Report on the attack on Ascension Health and the alleged involvement of Black Basta.
  • ASEC: Description of the ransomware attack, its impact, and the potential ramifications for healthcare organizations.

Blogs

Research Tools