Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
The group has also targeted critical infrastructure organizations in recent months. In November, 2022 for example, Black Basta targeted Maple Leaf Foods, a Canadian meat giant. After gaining access to Maple Leaf’s network and critical systems, Black Basta posted screenshots of technical documents, financial information and other sensitive files on their “Basta News” site. The company had to shut down their operations as a result of the attack, possibly impacting the food distribution supply chain in North American and Asian countries.
Researchers at Unit 42 say Black Basta is written in C++ and is cross-platform ransomware that impacts both Windows and Linux systems. By using anti-analysis techniques, the ransomware is able to avoid execution and detection in sandbox environments.
In order to quickly encrypt all of the files on a network, the ransomware encrypts in chunks of 64 bytes. The ransomware also tries to delete shadow copies or file backups using a command-line tool that manages Volume Shadow Copy Service. A jpg. file is then used to overwrite the desktop background of an infected computer with a message that reads, “your network is encrypted by the Black Basta group,” according to Unit 42.
Victims of the ransomware then find entire systems encrypted, with files given the extension .basta.
Researchers at TrendMicro believe that Black Basta members likely use stolen credentials in the early stages of attacks. These are likely purchased in darknet websites or underground forums, allowing the attackers to gain access to a victim’s system.
Several researchers believe that Black Basta did not start from scratch. Based on their research, Unit 42 suspects that Black Basta could include current or former members of Conti (also known by the names TrickBot, Wizard Spider and Ryuk). Conti is another ransomware group that went dark not long after its private chats were leaked by a pro-Ukrainian member of the gang as retaliation for Conti siding with Russia’s war in Ukraine.
Prior to Black Basta, Conti was considered to be one of the most successful ransomware groups, outlasting many other gangs that did not survive in 2022. In Episode 2 of ConversingLabs, a ReversingLabs podcast, ransomware expert Yelisey Boguslavskiy gave insight into Conti’s operations. His take was that Conti’s success was thanks to how they operated like a legitimate business, and said that “even if they disappear, they will come back stronger.” Nine months later, Conti has now lowered its profile and activity, while Black Basta has risen in popularity and success at the same time.
Unit 42’s reasoning behind this connection is based on the similarities found in the tactics, techniques and procedures (TTPs) between Conti and Black Basta. Those include the use of victim-shaming blogs, recovery portals, negotiation tactics, and the high number of quickly amassed victims. MalwareHunterTeam also suspects that Black Basta is derivative of Conti, noting that the two groups’ leak sites, payment sites, as well as rhetoric and behavior are highly similar.
Based on these researchers’ assumptions, it is possible that Boguslavskiy was correct in saying that Conti would never really go away, but simply reconstitute and “come back stronger.”
Considering the recent spring of attacks caused by Black Basta, it is more important than ever for organizations to stay vigilant and defend themselves against this ransomware threat.
ReversingLabs’ Black Basta YARA rule is designed to detect this ransomware within your environment with high fidelity and almost no false-positives.
Download the Black Basta YARA Rule from our GitHub page here:
To learn more about the prerequisites for using ReversingLabs’ YARA rules, consult our Github page. To learn more about how our threat analysts write these YARA rules, check out this blog post from ReversingLabs threat analyst Laura Dabelić.
ReversingLabs’ team of analysts are constantly surveying the threat landscape in an effort to better serve our customers and the greater security community. Contact us if you’d like to learn more about how we help organizations combat threats like malicious wipers and ransomware, or to schedule a demonstration.
SVGs are difficult to detect, can be snuck into content — and can do malicious and legitimate actions. Here's how malicious SVGs work.
One of the most effective attack methods I've analyzed this year runs on legitimate tools and willing users — and AV and EDR is blind to it.
