Blackbasta

How Blackbasta typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Black Basta.

1. T1047 Windows Management Instrumentation Execution

   What they do: Black Basta has used WMI to execute files over the network.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

2. T1059.001 PowerShell Execution

   What they do: Black Basta has used PowerShell scripts for discovery and to execute files over the network.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

3. T1059.003 Windows Command Shell Execution

   What they do: Black Basta can use `cmd.exe` to enable shadow copy deletion.

   What that means: Adversaries may abuse the Windows command shell for execution.

4. T1106 Native API Execution

   What they do: Black Basta has the ability to use native APIs for numerous functions including discovery and defense evasion.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

5. T1204.002 Malicious File Execution

   What they do: Black Basta has been downloaded and executed from malicious Excel files.

   What that means: An adversary may rely upon a user opening a malicious file in order to gain execution.

6. T1112 Modify Registry PersistenceDefense Impairment

   What they do: Black Basta has modified the Registry to enable itself to run in safe mode, to change the icons and file extensions for encrypted files, and to add the malware path for persistence.

   What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

7. T1543.003 Windows Service PersistencePrivilege Escalation

   What they do: Black Basta can create a new service to establish persistence.

   What that means: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

8. T1027.001 Binary Padding Stealth

   What they do: Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.

   What that means: Adversaries may use binary padding to add junk data and change the on-disk representation of malware.

9. T1036.004 Masquerade Task or Service Stealth

   What they do: Black Basta has established persistence by creating a new service named `FAX` after deleting the legitimate service by the same name.

   What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

10. T1036.005 Match Legitimate Resource Name or Location Stealth

    What they do: The Black Basta dropper has mimicked an application for creating USB bootable drivers.

    What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

11. T1480.002 Mutual Exclusion Stealth

    What they do: Black Basta will check for the presence of a hard-coded mutex `dsajdhas.0` before executing.

    What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.

12. T1497 Virtualization/Sandbox Evasion StealthDiscovery

    What they do: Black Basta can make a random number of calls to the `kernel32.beep` function to hinder log analysis.

    What that means: Adversaries may employ various means to detect and avoid virtualization and analysis environments.

13. T1497.001 System Checks StealthDiscovery

    What they do: Black Basta can check system flags and libraries, process timing, and API's to detect code emulation or sandboxing.

    What that means: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

14. T1622 Debugger Evasion StealthDiscovery

    What they do: The Black Basta dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.

    What that means: Adversaries may employ various means to detect and avoid debuggers.

15. T1222.002 Linux and Mac Permissions Defense Impairment

    What they do: The Black Basta binary can use `chmod` to gain full permissions to targeted files.

    What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

16. T1553.002 Code Signing Defense Impairment

    What they do: The Black Basta dropper has been digitally signed with a certificate issued by Akeo Consulting for legitimate executables used for creating bootable USB drives.

    What that means: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

17. T1688 Safe Mode Boot Defense Impairment

    What they do: Black Basta can reboot victim machines in safe mode with networking via `bcdedit /set safeboot network`.

    What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.

18. T1007 System Service Discovery Discovery

    What they do: Black Basta can check whether the service name `FAX` is present.

    What that means: Adversaries may try to gather information about registered local system services.

19. T1018 Remote System Discovery Discovery

    What they do: Black Basta can use LDAP queries to connect to AD and iterate over connected workstations.

    What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

20. T1082 System Information Discovery Discovery

    What they do: Black Basta can collect system boot configuration and CPU information.

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

21. T1083 File and Directory Discovery Discovery

    What they do: Black Basta can enumerate specific files for encryption.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

22. T1680 Local Storage Discovery Discovery

    What they do: Black Basta can enumerate volumes.

    What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

23. T1486 Data Encrypted for Impact Impact

    What they do: Black Basta can encrypt files with the ChaCha20 cypher and using a multithreaded process to increase speed.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

24. T1490 Inhibit System Recovery Impact

    What they do: Black Basta can delete shadow copies using vssadmin.exe.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

25. T1491.001 Internal Defacement Impact

    What they do: Black Basta has set the desktop wallpaper on victims' machines to display a ransom note.

    What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

26. T1529 System Shutdown/Reboot Impact

    What they do: Black Basta has used `ShellExecuteA` to shut down and restart the victim system.

    What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Software Blackbasta has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

The note this group leaves on a compromised machine. Click a filename to read it.

All of your files are currently encrypted by no_name_software.
 
These files cannot be recovered by any means without contacting our team directly.
 
DON'T TRY TO RECOVER your data by yourselves. Any attempt to recover your data (including the usage of the additional recovery software) can damage your files. However,
if you want to try - we recommend choosing the data of the lowest value.
 
DON'T TRY TO IGNORE us. We've downloaded a pack of your internal data and are ready to publish it on our news website if you do not respond.
So it will be better for both sides if you contact us as soon as possible.
 
DON'T TRY TO CONTACT feds or any recovery companies.
We have our informants in these structures, so any of your complaints will be immediately directed to us.
So if you will hire any recovery company for negotiations or send requests to the police/FBI/investigators, we will consider this as a hostile intent and initiate the publication of whole compromised data immediately.
 
DON'T move or rename your files. These parameters can be used for encryption/decryption process.
 
To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge.
 
You can contact our team directly for further instructions through our website :
 
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
 
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/
 
Your company id for log in: [snip]
Your company key: 3 of any of your dc through comma. Example: "DC1, DC2, DC3". You can type less if you have no enough
 
YOU SHOULD BE AWARE!
We will speak only with an authorized person. It can be the CEO, top management, etc.
In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company!
Inform your supervisors and stay calm!

Hello!

If you are reading this, it means we have encrypted your data and took your files.

DO NOT PANIC! Yes, this is bad news, but we will have a good ones as well. 
YES, this is entirely fixable!

Our name is BlackBasta Syndicate, and we are the largest, most advanced, and most prolific organized group currently existing. We are the ultimate cyber tradecraft with a credential record of taking down the most advanced, high-profile, and defended companies one can ever imagine. You can Google us later; what you need to know now is that we are business people just like you. 

We have your data and encrypted your files, but in less than an hour, we can put things back on track: if you pay for our recovery services, you get a decryptor, the data will be deleted from all of our systems and returned to you, and we will give you a security report explaining how we got you.

Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Login: [snip]

This is a link to a secure chat. We will talk there. Inside that chat, we will share a second designated link that only your special team will be able to see.

For now, think about the following. 

This incident hits your network and is stopping you from operating properly. The sooner you get back on track, the better it is.

See you in the secure chat.

ATTENTION!
Your network has been breached and all data was encrypted. Please contact us at:
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ 


Login ID: [snip]


*!* To access .onion websites download and install Tor Browser at:

   https://www.torproject.org/ (Tor Browser is not related to us)

*!* To restore all your PCs and get your network working again, follow these instructions:

- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.

Please follow these simple rules to avoid data corruption:

- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. 

- Do not hire a recovery company. They can't decrypt without the key. 
They also don't care about your business. They believe that they are 
good negotiators, but it is not. They usually fail. So speak for yourself.


Waiting you in a chat.

ATTENTION!
Your network has been breached and all data was encrypted. Please contact us at:
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/


Login ID: [snip]


*!* To access .onion websites download and install Tor Browser at:

   https://www.torproject.org/ (Tor Browser is not related to us)

*!* To restore all your PCs and get your network working again, follow these instructions:

- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.

Please follow these simple rules to avoid data corruption:

- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. 

- Do not hire a recovery company. They can't decrypt without the key. 
They also don't care about your business. They believe that they are 
good negotiators, but it is not. They usually fail. So speak for yourself.


Waiting you in a chat.

Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
You can contact us and decrypt one file for free on this TOR site
(you should download and install TOR browser first https://torproject.org)
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/

Your company id for log in: [snip]

Ransom-note text from RansomLook, licensed CC BY 4.0.