ZeroFox Intelligence Flash Report - Bassterlord Returns to Sell Third Malicious Publication

Product Serial: F-2024-04-12a

TLP:CLEAR

In this flash report, ZeroFox researchers report on a recent deep and dark web post by the threat actor Baasterlord who claims to be selling a new malicious publication, and also to have suffered significant disruption during February 2024 law enforcement operations.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On April 7, 2024, threat actor “Bassterlord” posted in the the deep and dark web (DDW) forum xss. The thread addresses multiple topics but was locked shortly after upon the author’s request.
Bassterlord claims that following the February 2024 law enforcement (LE) disruption of LockBit, their associated group, the National Hazard Agency (NHA), was under close surveillance by the Federal Bureau of Investigation (FBI). This led to the seizure of all of NHA’s funds (including those stored in XMR) and the cessation of NHA’s operations.
A new educational manual was also advertised for sale, which allegedly assists threat actors in mass brute force targeting of corporations, including how to “organize” attacks.