March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – IcedID banking Trojan – Active IOCs
December 22, 2022
Rewterz Threat Advisory – Multiple Microsoft Office Graphics Vulnerabilities
December 22, 2022
Rewterz Threat Alert – IcedID banking Trojan – Active IOCs
December 22, 2022
Rewterz Threat Advisory – Multiple Microsoft Office Graphics Vulnerabilities
December 22, 2022
Severity
High
Analysis Summary
Black Basta is a new emerging ransomware that encrypts data stored on clients’ hard drives. It has been active since April 2022 and employs a double-extortion attack technique. In July 2022, the Black Basta ransomware group has added a new capability that encrypts VMware ESXi virtual machines (VMs) on Linux servers
A new strain of the Black Basta ransomware that supports encryption of VMWare ESXi servers. They have been reporting on similar encryptors issued by a number of different groups, including LockBit, HelloKitty, BlackMatter, REvil, AvosLocker, RansomEXX, and Hive, among others.
Black Basta’s ransomware binary, like other Linux encryptors, will search for the /vmfs/volumes where virtual machines are kept on the compromised ESXi servers (if no such folders are found, the ransomware exits).
To encrypt the data, the ransomware uses the ChaCha20 algorithm. It also uses multithreading to make use of many processors and accelerate the encryption operation. The ransomware appends the .basta extension to encrypted filenames and creates readme.txt ransom notes in each folder.
Impact
- Files Encryption
Indicators of Compromise
MD5
432ef25107f4c29775ecc469699d02fb
SHA-256
4da76668000e24cbd75973f45a6a2c273c6292161348fa84f996d5f5e6fd4152
SHA-1
c74dc4765adcf729367068b4570ca3ea1bba7e0d
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicator of compromise (IOCs) in your environment utilizing your respective security controls
- Maintain cyber hygiene by updating your anti-virus software and implementing patch management lifecycle.
- Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
- Emails from unknown senders should always be treated with caution.
- Never trust or open links and attachments received from unknown sources/senders