Rewterz Threat Alert – Black Basta Ransomware – Active IOCs

Severity

High

Analysis Summary

Black Basta is a new ransomware that encrypts data stored on clients’ hard drives. It has been active since April 2022 and employs a double-extortion attack technique. In July 2022, the Black Basta ransomware group has added a new capability that encrypts VMware ESXi virtual machines (VMs) on Linux servers

Researchers reported a new strain of the Black Basta ransomware that supports encryption of VMWare ESXi servers. They have been reporting on similar encryptors issued by a number of different groups, including LockBit, HelloKitty, BlackMatter, REvil, AvosLocker, RansomEXX, and Hive, among others.

Black Basta’s ransomware binary, like other Linux encryptors, will search for the /vmfs/volumes where virtual machines are kept on the compromised ESXi servers (if no such folders are found, the ransomware exits).

To encrypt the data, the ransomware uses the ChaCha20 algorithm. It also uses multithreading to make use of many processors and accelerate the encryption operation. The ransomware appends the .basta extension to encrypted filenames and creates readme.txt ransom notes in each folder.

Also, experts have discovered a new connection between the Black Basta ransomware gang and the QBot malware operation in the threat landscape. QBot malware is being used by the Black Basta gang to propagate laterally throughout the target network.

Impact

• File Encryption

Indicators of Compromise

MD5

• eff424376edca5680b90ea9fedad163d

SHA-256

• 48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb

SHA-1

• 3c13c1e54d2d7991c1c3452ae89888a8e7a47763

Remediation

• Block all threat indicators at your respective controls
• Search for IOCs in your environment.