MITRE ATT&CKsoftware (malware)
S1070 Black Basta
- Domain
- enterprise
- Platforms
- Windows, ESXi
- Version
- 1.2
- Created
- 2023-03-08
Description
Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. Black Basta operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. Black Basta affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the Black Basta RaaS operators could include current or former members of the Conti group.
Related
Uses · MITRE ATT&CK (26)
- T1688 Safe Mode Boot technique
- T1680 Local Storage Discovery technique
- T1480.002 Mutual Exclusion sub-technique
- T1622 Debugger Evasion technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1491.001 Internal Defacement sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.001 Binary Padding sub-technique
- T1553.002 Code Signing sub-technique
- T1222.002 Linux and Mac Permissions sub-technique
- T1543.003 Windows Service sub-technique
- T1529 System Shutdown/Reboot technique
- T1497 Virtualization/Sandbox Evasion technique
- T1490 Inhibit System Recovery technique
- T1486 Data Encrypted for Impact technique
- T1007 System Service Discovery technique
- T1018 Remote System Discovery technique
- T1047 Windows Management Instrumentation technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
- T1112 Modify Registry technique
Referenced by MITRE ATT&CK · uses (1)
- G1046 Storm-1811 group
References
- https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware Avertium Black Basta June 2022
- https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/ Cyble Black Basta May 2022
- https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware Palo Alto Networks Black Basta August 2022
- https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ NCC Group Black Basta June 2022
- https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence Deep Instinct Black Basta August 2022
- https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/ Minerva Labs Black Basta May 2022