Black Basta’s New Bag of Tricks: Evolving Tactics Keep Cyber Defenders on Their Toes

Hot Take:

Black Basta: The Michael Jordan of ransomware – always adapting, always winning, and always leaving a trail of defeated companies in their wake. These cybercriminals have more moves than a chess grandmaster on caffeine!

Key Points:

• Black Basta ransomware gang has been active since April 2022 with over 500 successful attacks worldwide.
• They employ a double-extortion strategy, combining data theft and encryption for hefty ransom demands.
• Post disruption of QBot botnet, Black Basta switched to new initial access tools like DarkGate and SilentNight.
• Mandiant reports Black Basta’s shift to custom-developed malware such as DawnCry, DaveShell, and PortYard.
• Continued use of “living off the land” binaries and tools like Windows certutil and Rclone to facilitate attacks.

Resilience Thy Name is Black Basta

When life gives you QBot botnet disruption, make SilentNight malvertising! Black Basta’s ability to bounce back from the QBot takedown by law enforcement is nothing short of a cyber-criminal masterclass. Their pivot to using DarkGate and SilentNight malware for initial access shows that they’re like the Terminator – they absolutely will not stop, ever, until your data is encrypted and your wallet is lighter.

Custom Malware: The New Black

Move over, off-the-shelf tools; Black Basta is going bespoke. According to Mandiant, the gang has gradually transitioned from using commonly available hacking tools to rolling out their own custom malware. DawnCry, their custom memory-only dropper, sounds more like a Game of Thrones character but is far more destructive. This dropper kicks off a multi-stage infection process that would make even the most seasoned IT professional break out in a cold sweat.

Innovative Tools for Innovative Crimes

Black Basta’s new toolkit is like the Swiss Army knife of ransomware operations. CogScan, SystemBC, KnockTrock, and KnowTrap – these tools could easily be mistaken for the latest tech gadgets if they weren’t so nefarious. CogScan, a .NET reconnaissance tool, gathers data like a nosy neighbor peeking through your blinds. Meanwhile, SystemBC and KnockTrock ensure that the ransomware spreads faster than gossip at a high school reunion.

“Living Off the Land” – The Black Basta Way

Not satisfied with just custom tools, Black Basta continues to use “living off the land” binaries and readily available utilities. The Windows certutil command-line utility and the Rclone tool are just some of the everyday items in their hacking toolbox. It’s like they’re using the Swiss army knife of hacking to spread their ransomware and exfiltrate data. MacGyver would be proud.

Global Threat Level: Black Basta

With a hit list that includes big names like Veolia North America, Hyundai Motor Europe, and Keytronic, Black Basta isn’t just playing in the minor leagues. They’ve got access to zero-day vulnerabilities and exploits that make them one of the top players in the ransomware space. They’re like the cyber equivalent of a Bond villain, minus the cat and the nefarious monologues.