Threat Assessment: Black Basta Ransomware
Summary: Black Basta is a ransomware-as-a-service operation that emerged in April 2022, with evidence of development since February, and its affiliates had compromised over 75 organizations at the time of Unit 42's publication, listing victims on a Tor leak site called Basta News. The ransomware is written in C++, targets Windows and Linux (including a June 2022 VMware ESXi variant), encrypts with ChaCha20 and RSA-4096 in 64-byte chunks with 128 bytes left unencrypted between regions, deletes shadow copies via vssadmin.exe, and uses QBot for both initial access and lateral movement.
Why it matters: At least 20 victims were posted in the group's first two weeks, which Unit 42 reads as a steady source of initial access and possible ties to current or former Conti members - meaning the affiliate capacity behind this was built before the brand name appeared.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·