ctrlINT What the industry said about every indicator, with the quote

BlackBastaMalware

Black Basta is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.From MISP Galaxy

Last reported 6 months ago, by Zscaler ThreatLabz2 reports

ATT&CK techniques

4 techniques · each with the sentence it comes from
  1. T1053.005Scheduled Task

    “…anti-sandbox evasion technique.If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks by executing the following command:schtasks.exe /s "localhost" /ru "SYSTEM" /create /f /sc ONSTART /TN \Mozilla\UpdateTask /TR "<…”

    Zscaler ThreatLabzVendor
  2. T1219Remote Access Tools

    “…g, and fake tech support scams), strict enforcement of multi-factor authentication (MFA), and monitoring for the anomalous use of remote access tools like Quick Assist.”

    Zscaler ThreatLabzVendor
  3. T1564.014Extended Attributes

    “A file is downloaded to $tmpdir (a random location under /var/folders), while all extended attributes are stripped from the file.”

    HuntressVendor
  4. T1684Social Engineering

    “This includes enhanced user training to recognize and report social engineering attacks (spam bombing, vishing, and fake tech support scams), strict enforcement of multi-factor authentication (MFA), and monitoring for the anomalous use of remote access tools like Quick Assist.”

    Zscaler ThreatLabzVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “IntroductionIn February 2022, BlackBasta emerged as a successor to Conti ransomware and quickly rose to prominence.”

    Zscaler ThreatLabzVendor
    Payouts King Takes Aim at the Ransomware Throne

  2. “GhostSocks, a tool previously utilized by the BlackBasta ransomware group, turns compromised systems into proxies.”

    HuntressVendor
    How Fake OpenClaw Installers Spread GhostSocks Malware

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with BlackBasta here?
No account needed. We do not store your IP address.