Rewterz Threat Alert – Black Basta Ransomware: Linux Version Targets VMware ESXi servers – Active IOCs

Severity

High

Analysis Summary

The Black Basta ransomware group has added a new capability that encrypts VMware ESXi virtual machines (VMs) on Linux servers. Black Basta is a new ransomware that encrypts data stored on clients’ hard drives. It has been active since April 2022 and employs a double-extortion attack technique.

Recently, researchers reported a new strain of the Black Basta ransomware that supports encryption of VMWare ESXi servers. They have been reporting on similar encryptors issued by a number of different groups, including LockBit, HelloKitty, BlackMatter, REvil, AvosLocker, RansomEXX, and Hive, among others.

Black Basta’s ransomware binary, like other Linux encryptors, will search for the /vmfs/volumes where virtual machines are kept on the compromised ESXi servers (if no such folders are found, the ransomware exits).

To encrypt the data, the ransomware uses the ChaCha20 algorithm. It also uses multithreading to make use of many processors and accelerate the encryption operation. The ransomware appends the .basta extension to encrypted filenames and creates readme.txt ransom notes in each folder.

Also, experts have discovered a new connection between the Black Basta ransomware gang and the QBot malware operation in the threat landscape. QBot malware is being used by the Black Basta gang to propagate laterally throughout the target network.

Impact

• File Encryption

Indicators of Compromise

MD5

• 32f17040ddaf3477008d844c8eb98410

SHA-256

• 0d6c3de5aebbbe85939d7588150edf7b7bdc712fceb6a83d79e65b6f79bfc2ef

SHA1

• b363e038a6d6326e07a02e7ff99d82852f8ec2d2

URL

• https[:]//aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd[.]onion/

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicator of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.