Black Basta Ransomware: Why You Should Worry And How You Can Defend

What is Black Basta?

Black Basta is ransomware as a service (RaaS) that appeared in April 2022. There is, however, evidence that it has been developed since February. Black Basta operators employ a double extortion technique. That is, they encrypt files on targeted organizations’ systems and demand a ransom for decryption. In addition to encrypting files on targeted organizations’ systems and demanding ransom, they also maintain a dark web leak site. Here, they threaten to publish sensitive information if a ransom is not paid.

From the time Black Basta emerged, Black Basta affiliates were very active in deploying ransomware and extorting organizations. According to the information posted on the leak site, Black Basta affiliates have compromised over 75 organizations despite only being active for a few months.

The ransomware is written in C++ and affects both Windows and Linux systems. The ransomware encrypts users’ data with ChaCha20 and RSA-4096, and in order to speed up the encryption process, it encrypts 64-byte chunks with 128 bytes of unencrypted data between each region. During the encryption process, the faster ransomware is able to compromise systems, the more likely it is that defenses will be activated before the system is compromised. It is one of the key factors affiliates look for when joining a Ransomware-as-a-Service company.

Black basta Ransom Background and Note

Blaack Basta Ransomware Blog – Victim List

Why is Black Basta so dangerous?

Besides the rapidly-growing victim list and the plethora of variants, Black Basta ransomware is notable for some other reasons. Among Black Basta’s victims are energy and utility companies across the globe and in the US.

In addition to versions that target Windows systems, VMWare ESXi variants of Black Basta have been discovered targeting Linux virtual machines as well.

Furthermore, many attacks have utilized Qakbot (also known as QBot) to spread throughout an organization, perform reconnaissance, steal data, and execute payloads.

The ransomware spawns a mutex with a string of dsajdhas.0 to ensure a single instance of the malware is running at a time. Then it will iterate through the entire file system, encrypting files with a file extension of .basta.

It writes the <random-charecters>.ico and <random-charecters>.jpg files to the %TEMP% directory. The .jpg file is leveraged to overwrite the desktop background to the ransom warning as shown in the aforementioned figure.

Additionally, a group policy object is created on compromised domain controllers to disable Windows Defender and anti-virus software.

Tactics, Techniques and Procedures

We have observed Black Basta affiliates leveraging the following TTPs:

Table 1. Tactics, techniques and procedures for Black Basta activity.

How to Stay Protected from Black Basta Ransomware?

There are several ways that individuals and organizations can protect themselves against Black Basta and other types of ransomware. One of the most effective ways is to take regularly back up important data to an external hard drive or cloud-based storage service. This way, if the data is encrypted or lost due to ransomware, it can be restored from the backup. Other protective measures include deploying state-of-art endpoint protection software like ThreatResponder.

NetSecurity’s ThreatResponder, with its diverse capabilities, can help your team detect the most advanced cyber threats, including APTs, zero-day attacks, and ransomware attacks.

It can also help automate incident response actions across millions of endpoints, making it easy, fast, and hassle-free.

Want to try our ThreatResponder, cutting-edge Endpoint Detection & Response (EDR), and ThreatResponder FORENSICS, the Swiss knife for forensic investigators in action? Click on the below button to request a free demo of our NetSecurity’s ThreatResponder platform.