Black Basta

last quarter featured a dominant voice phishing (vishing) campaign deploying Cactus and Black Basta ransomware that was significantly less present this quarter

Attackers leverage a variety of initial infection vectors to deliver Black Basta, such as Qakbot, phishing, vulnerability exploitation, and email attachments.

On 4 November last year, an external user signed into a customer environment under the display name “IT Support”... Within twenty-eight minutes they had opened a Quick Assist screen-share session against a target who believed he was speaking to colleagues.

Attackers leverage a variety of initial infection vectors to deliver Black Basta, such as Qakbot, phishing, vulnerability exploitation, and email attachments.

The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'

The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions. | APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Blue Mockingbird has used batch script files to automate execution and deployment of payloads. During HomeLand Justice, threat actors used Windows batch files for persistence and execution.

The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.

Examples include: "Sandworm Team leveraged Microsoft Office attachments which contained malicious macros..."; "Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs"; "Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files."

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

It will then hijack an existing Windows service and uses it to launch the ransomware encryptor executable. In our tests, the Windows Service that was hijacked was the 'Fax' service.

Agent Tesla can achieve persistence by modifying Registry key entries. Attor's dispatcher can modify the Run registry key. Kimsuky has also modified the registry entry for HKCU:\Software\Microsoft\Windows\CurrentVersion\Run registry key for persistence with the name WindowsSecurityCheck. PLAINTEE uses reg add to add a Registry Run key for persistence.

Black Basta has been observed spreading via Group Policy Objects (GPO).

It will then hijack an existing Windows service and uses it to launch the ransomware encryptor executable. In our tests, the Windows Service that was hijacked was the 'Fax' service.

Agent Tesla can achieve persistence by modifying Registry key entries. Attor's dispatcher can modify the Run registry key. Kimsuky has also modified the registry entry for HKCU:\Software\Microsoft\Windows\CurrentVersion\Run registry key for persistence with the name WindowsSecurityCheck. PLAINTEE uses reg add to add a Registry Run key for persistence.

the tenants they registered for the operation carried display names so generic that they passed unnoticed: ‘Help Desk’, ‘Help Desk IT’, ‘Help Desk Support’, ‘IT Support’.

Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.

The ransomware deletes all Volume Shadow Copies by running the “C:\Windows\SysNative\vssadmin.exe delete shadows /all/quiet” command.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

Black Basta has been observed spreading via Group Policy Objects (GPO).

The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.

During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.

The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."

The malicious process starts enumerating the files on the drive.

FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.

The cloud and software giant’s threat intelligence team had already documented the same operators abusing the Quick Assist remote support tool since mid-April that year... Within twenty-eight minutes they had opened a Quick Assist screen-share session against a target

Examples include 'Aquatic Panda used WMI for lateral movement in victim environments,' 'Deep Panda group is known to utilize WMI for lateral movement,' and 'Cinnamon Tempest has used Impacket for lateral movement via WMI.'

Black Basta will steal corporate data and documents before encrypting a company's devices. This stolen data is then used in double-extortion attacks.

Attackers leverage a variety of initial infection vectors to deliver Black Basta, such as Qakbot, phishing, vulnerability exploitation, and email attachments.

Each file that is not skipped by the previously mentioned exclusions is encrypted using the ChaCha20 cypher. ... Following successful encryption of a file, its extension is changed to .basta

These result in the deletion of shadow copies ensuring they cannot be used for recovery purposes. ... modified configurations for the Veeam backup jobs and deleted the backups of the hosted virtual machines.

In an earlier variant of Black Basta, a file named dlaksjdoiwq.jpg is created in the Temp directory populated with instructions from the attacker. The newly created image is set as the Desktop wallpaper.

The ransomware will now reboot the computer into Safe Mode with Networking, where the hijacked Windows service will start and automatically begin to encrypt the files on the device.

file1.bat : a batch file designed to set up the system with autologon as the newly-created administrative user AdminBac, reboot into Safe Mode ... file2.bat : a second batch file, executed in Safe Mode via a registry key, designed to unpack the ransomware binary from the encrypted archive

In late May 2024, Microsoft watched a financially motivated cybercriminal group it tracks as Storm-1811 do something that traditional perimeter controls were not built to see- it logged into Teams, said hello, and asked for help.