Black Basta Ransomware: Tactics & Prevention | Qualys
Summary: Black Basta is a ransomware-as-a-service group first spotted in April 2022 that has affected more than 500 organizations globally across North America, Europe, and Australia, using double extortion to demand payment for both decryption and non-release of stolen data. Affiliates gain initial access through phishing, Qakbot, Cobalt Strike, RDP, and exploitation of known vulnerabilities, then move laterally, exfiltrate data with Rclone and WinSCP, delete shadow copies via vssadmin.exe, reboot into safe mode with bcdedit.exe, and encrypt files with ChaCha20 under an RSA-4096 key.
Why it matters: More than 500 organizations have already been hit by a group whose playbook includes disabling Windows Defender, deleting shadow copies, and rebooting into safe mode to strip endpoint defenses before encryption - meaning recovery depends on backups the ransomware is explicitly designed to destroy.
Read the original at Qualys Blog ↗
- Topics
- Ransomware
- Related
- How adversaries use politics for compromise Cyber Risks ·Wasted Locker Goes "Big-Game Hunting" in 2020 Cyber Risks ·