Profile: Black Basta Ransomware

Profile: Black Basta Ransomware

Product Serial: P-2022-08-16a

TLP: GREEN

In the following profile, ZeroFox Intelligence provides an overview on the Black Basta ransomware group.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:00 AM (EDT) on August 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Black Basta is a highly-effective ransomware strain used by threat actors to infect and extort victims. Consistent with most ransomware collectives, Black Basta operators exfiltrate sensitive corporate data before encrypting devices and leverage double-extortion tactics, threatening to release the exfiltrated data if ransom demands are not met. The ransomware was identified in mid-April 2022 following the first reported incidents of compromise, though evidence indicates it was in development as early as February 2022. The group also made its presence known on the Russian underground forum Exploit.in in late April; ZeroFox Intelligence observed a user with the name “Black Basta” posting an advertisement that offered to purchase and monetize access to corporate networks for a percentage of profits. According to the announcement, the actor was interested in organizations located in the United States, Canada, the United Kingdom, Australia, and New Zealand.

Since its emergence, researchers have linked Black Basta to Conti ransomware, with intelligence suggesting that the group is likely one of several Conti subdivisions forming part of a measured Conti rebranding. Researchers tracking Black Basta’s activity have indicated that the group—which appeared a month before Conti announced its shutdown—has shown signs of overlap with Conti’s tactics, techniques, and procedures (TTPs), citing similarities between the groups’ data leak sites (DLS), payment sites, recovery portals, and negotiation methods. Notably, Conti denied reports linking it to Black Basta in May 2022, though this is to be expected if the group is attempting to hide its affiliations to avoid potential backlash.

ZeroFox Intelligence has identified no evidence directly linking Black Basta to Conti but assesses with moderate confidence that Black Basta likely includes former members of Conti or other previously shuttered groups. ZeroFox Intelligence notes the tendency for ransomware gangs and affiliates to rebrand or restructure to divert attention from authorities or to avoid sanctions. For instance, Darkside—responsible for the Colonial Pipeline attack in May 2021—is considered to have resurfaced as BlackMatter after ceasing its operations due to intense scrutiny from authorities. Likewise, Conti is previously assessed to have succeeded Ryuk ransomware in 2020 and, due to the significant disruption inflicted by the ContiLeaks breach in February 2022, is highly likely to be reshaping the organization again in an attempt to avoid further exposure.

The rate at which Black Basta has accumulated victims and developed its capabilities also indicates the involvement of seasoned ransomware operatives. In the first two months of operating, Black Basta offered its own Ransomware-as-a-Service, partnered with QBot malware, and developed a Linux-based variant to target VMware ESXi virtual machines (VMs) on enterprise servers—putting it on par with groups such as BlackMatter, Hive, and Lockbit. As a result, Black Basta has quickly become one of the most prolific variants. Between April and August 2022, Black Basta accounted for the third-highest number of ransomware incidents among the most notable strains, targeting over 50 organizations globally across multiple industries. ZeroFox Intelligence notes that Black Basta has so far shown a propensity to target organizations within the manufacturing, retail, and construction industries.