Hello everyone and welcome back to the Cognixia
podcast
The US Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, Department of Health & Human Services, and the Multi-State Information Sharing & Analysis Center issued a joint cybersecurity advisory. This advisory aimed to share more information about the “Black Basta”. Black Basta affiliates have been attacking entities across the United States, Canada, Japan, the UK, Australia, and New Zealand. Over 500 organizations have been impacted globally to date. At least 12 of the 16 critical infrastructure sectors have had data stolen from them so far.
According to Kaspersky in its latest findings about the state of ransomware in 2024, Black Basta is ranked the 12th most active ransomware family in 2023, with a 71% rise in the number of victims in 2023 as compared to 2022.
But, what is Black Basta?
Black Basta is a Ransomware-as-a-Service whose first variants were discovered in April 2022. It is believed that Black Basta might have links to FIN7, a threat actor also called “Carbanak” active since 2012. It is affiliated with multiple ransomware operations. Black Basta’s modus operandi is quite similar to the older Conti ransomware structure, however, no proven links have been found between the two.
What is Black Basta’s Modus Operandi?
Black Basta affiliates employ a multi-pronged approach to infiltrate target networks. Their tactics focus on gaining initial access through various methods.
One common technique involves phishing attacks. These deceptive emails aim to trick recipients into surrendering sensitive information or clicking malicious links. These links can download malware or redirect users to fake login pages designed to steal credentials.
Another tactic Black Basta utilizes is exploiting known vulnerabilities in software or systems. If these vulnerabilities haven't been addressed through security patches, attackers can take advantage of them to gain unauthorized access.
In some cases, Black Basta affiliates may opt to acquire valid credentials from underground marketplaces. These credentials, often obtained through previous cyberattacks, are sold by illicit actors known as Initial Access Brokers. By purchasing login information for targeted systems, Black Basta can bypass the initial intrusion stage altogether.