April 29, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Researchers Discover ‘LLMjacking’ Campaign Aimed at Cloud-Hosted AI Models – Active IOCs
May 13, 2024Multiple VMware Avi Vulnerabilities
May 13, 2024Researchers Discover ‘LLMjacking’ Campaign Aimed at Cloud-Hosted AI Models – Active IOCs
May 13, 2024Multiple VMware Avi Vulnerabilities
May 13, 2024
Severity
High
Analysis Summary
It was recently reported by CISA and the FBI that affiliates of the Black Basta ransomware had compromised more than 500 companies between April 2022 and May 2024.
The gang also encrypted and stole data from at least 12 out of 16 critical infrastructure sectors, according to a joint report released in collaboration with the Department of Health and Human Services (HHS) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). Affiliates of Black Basta have targeted more than 500 businesses in the private sector and critical infrastructure in North America, Europe, and Australia, including healthcare facilities.
In April 2022, Black Basta became known as a ransomware-as-a-service (RaaS) operation. Since then, several well-known victims have been compromised by its affiliates, including the American Dental Association, the Toronto Public Library, the German defense contractor Rheinmetall, Hyundai's European division, the U.K. technology outsourcing company Capita, the industrial automation company and government contractor ABB, and Yellow Pages Canada.
Following a string of embarrassing data breaches that led to its closure in June 2022, the Conti cybercrime syndicate broke up into several factions, one of which is thought to be Black Basta. In its first two weeks of operation, the threat organization targeted at least 20 victims, demonstrating its familiarity with ransomware and its reliable source of initial access.
The fact that the skilled ransomware operators behind Black Basta are so sophisticated and reluctant to recruit or advertise on Dark Web forums adds credence to the theories that the newly formed Black Basta is either connected to other Russian-speaking cyber threat groups or is simply a rebranded version of the RaaS threat group Conti. Up to November 2023, more than 90 victims paid at least $100 million to this Russian-affiliated ransomware group.
The agencies emphasized to healthcare organizations the heightened risks that this ransomware operation poses, and they asked them to make sure that these suggested mitigations are implemented to thwart any future attacks. Because of their size, reliance on technology, access to personal health information, and the particular effects of patient care disruptions, healthcare companies are appealing targets for cybercrime actors.
To reduce the likelihood of a Black Basta ransomware attack, defenders should keep operating systems, software, and firmware up to date, mandate phishing-resistant Multi-Factor Authentication (MFA) for as many services as they can, and teach users how to spot and report phishing attempts. They should also use mitigations mentioned in the StopRansomware Guide, apply CISA-recommended mitigations, and often back up important systems and device configurations to facilitate quicker repairs and restorations to protect remote access software.
Impact
- Financial Loss
- Operational Disruption
- Sensitive Information Theft
Indicators of Compromise
Domain Name
- trailshop.net
- realbumblebee.net
- recentbee.net
- investrealtydom.net
- webnubee.com
IP
- 46.161.27.151
- 185.219.221.136
MD5
- ce99e91e6c2a6defe1a86462870ba321
- 2d5cefe02cef5d14da7d609f0ccad1bc
- d513a09a10122ba8cd6df651aae35fb0
- f309d2c8a5c82367f0fd2be457055813
- f74cec233a9609461e7518dd4c90207b
- 24544104aaa9931b8cc0c68622864488
- 640132bbf92eb7c794a5c593fbb362de
- 497ef4779c6770e4497adf0bc71655f1
- 8bae9edbf5b1035cd52ca45b23fee29d
SHA-256
- 58ddbea084ce18cfb3439219ebcf2fc5c1605d2f6271610b1c7af77b8d0484bd
- 39939eacfbc20a2607064994497e3e886c90cd97b25926478434f46c95bd8ead
- 5b2178c7a0fd69ab00cef041f446e04098bbb397946eda3f6755f9d94d53c221
- d15bfbc181aac8ce9faa05c2063ef4695c09b718596f43edc81ca02ef03110d1
- 05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431
- 1c1b2d7f790750d60a14bd661dae5c5565f00c6ca7d03d062adcecda807e1779
- 360c9c8f0a62010d455f35588ef27817ad35c715a5f291e43449ce6cb1986b98
- 62e63388953bb30669b403867a3ac2c8130332cf78133f7fd4a7f23cdc939087
- 7ad4324ea241782ea859af12094f89f9a182236542627e95b6416c8fb9757c59
SHA1
- f3d31b5d4bec32a50e8a76430c801d1b8c4e6b70
- c419ed515b5267bb39870bdedcdd8dd8b172574c
- 79054b409cb1c7a36aafd9a9915f948e2f018734
- fe540dd2ba50edb2ecbef0c0180e732ff2403592
- 92408a8233567f8b10f30f83dfcdd98effe96dca
- c69ffb5061ec42c876531f153c5b94302d6d9daf
- ad0e80af469165da713467b13d9a2500ee340427
- 328a8793323f11c1d0c5f3ddedf4ae10caafb063
- a1a698a0bdda712905950ba6414bb1fcabdd8e84
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
- Maintain Offline Backups - In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
- Conduct regular backups of your important data and ensure that these backups are stored offline or in a separate network. This will help protect your data from being compromised by ransomware attacks.
- Deploy advanced threat detection and monitoring solutions to identify potential ransomware activity in real time. Monitor network traffic, system logs, and behavior anomalies to detect and respond to ransomware incidents promptly.
- Never trust or open links and attachments received from unknown sources/senders.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- If a device on the network has been infected with ransomware, immediately disconnect it from the network to prevent the malware from spreading to other devices. This will help contain the attack and limit further damage.
- Disconnect external storage devices if connected.
- Implement the principle of least privilege by granting employees the minimum access rights required to perform their tasks. Regularly review and update user access privileges to prevent unauthorized access and limit the impact of ransomware.
