Attack Flow Steps:

: Ransomware-as-a-Service (RaaS) with fast hands-on-keyboard intrusions and double extortion tactics. : Initial access via phishing with malicious documents. : VPN/RDP logins with valid credentials from purchased access. : Multiple initial access vectors available. : Loader malware used for initial access. : DLL side-loading and execution via rundll32. : Execution using msiexec LOLBin. : Used for execution and lateral movement. : Persistence via scheduled tasks. : Persistence via Windows services. : Persistence via registry run keys. : LSASS memory access for credential dumping. : Lateral movement via SMB and admin shares. : Lateral movement via RDP. : C2 via beacon-like HTTPS traffic with abnormal JA3/TLS fingerprints. : Data staging before exfiltration. : Large outbound data transfers to cloud storage or VPS IPs. : Encryption of Windows and ESXi hosts with ransom notes. : Windows systems targeted for encryption. : VMware ESXi virtualized infrastructure targeted for encryption. : Primary target industry - healthcare sector. : Target industry - manufacturing sector. : Target industry - Managed Service Providers and IT services. : Use of archive tools (7-Zip, WinRAR) on file servers. : Archive tool used for data collection. : Archive tool used for data collection. : Password spraying across privileged accounts. : Office apps spawning PowerShell. : Office apps spawning cmd.exe. : Cloud storage used for data exfiltration. : VPS IPs used for data exfiltration. : Failed MFA followed by successful login attempts

MITRE ATT&CK Techniques:

T1566

T1078

T1218.011

T1218.007

T1053

T1543

T1547

T1003

T1021.002

T1021.001

T1071

T1074

T1567

T1486

T1560

T1110.003

T1059.001

T1059.003

T1621

Back to Gallery

Black Basta

Nermin Smajic

21 days ago

93 views

32 nodes

Black Basta is a Russian-language, financially motivated ransomware operation (RaaS) that emerged in 2022 and is known for fast, hands-on intrusions, double-extortion data theft, and attacks against high-value organizations across North America and Europe.

React Flow