![](\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/06\/black-basta-anatomy-of-the-attack.jpg?resize=491%2C149&ssl=1\")
<\/p>\nIn the constantly evolving realm of cyber threats, new groups consistently arise, creating turmoil for organizations worldwide. One such group that gained infamy in 2022 is the Russian-speaking threat actor known as Black Basta. With their advanced techniques and highly publicized attacks, Black Basta has become a significant worry for organizations in Europe and English-speaking nations. This blog examines the key traits of Black Basta and offers insights into their recent activities, including their targeted attack on ABB, a renowned automation specialist. DNS, as always, is leveraged during the Black Basta attack chain.<\/p>\n
<\/p>\n
Uncovered in 2022, Black Basta is an aggressive and highly active cybercriminal organization. Their targets span across both public and private sector entities, employing various tactics to infiltrate systems and extract sensitive data. This group has been associated with the financial cybercrime gang FIN7 (also referred to as Carbanak). Black Basta is known for their use of double extortion methods. This approach involves encrypting company data and demanding substantial ransoms for decryption and additional sums for preventing public exposure of the data.<\/p>\n
Black Basta has consistently targeted organizations in Europe and English-speaking countries. Among their victims are well-known entities such as the American Dental Association (ADA), Sobeys, Knauf, Yellow Pages Canada, and most recently, ABB.<\/p>\n
Prior to the ABB attack, Black Basta was behind a string of cyberattacks impacting organizations in the US, Canada, and Europe:<\/p>\n
On May 7th, 2023, Black Basta targeted ABB, a multinational company specializing in industrial control systems (ICS) and SCADA systems for manufacturing and energy suppliers. The breach resulted in the disabling of numerous devices within ABB\u2019s infrastructure.<\/p>\n
In response ABB promptly severed VPN connections with its customers in order to prevent the ransomware from spreading. This proactive step aimed to contain the impact and protect other organizations connected to ABB\u2019s network.<\/p>\n
ABB further responded publicly to the attack on May 12th, assuring customers and partners that they were actively addressing the situation and minimizing its effects. Most of ABB\u2019s systems have been restored, and ABB continues to deliver secure services to its customers.<\/p>\n
Black Basta typically initiates the attack chain by employing spear-phishing campaigns in order to gain initial access. Black Basta collaborates with a category of cyber criminals called initial access brokers (IABs) IABs offer corporate network access in exchange for payment. These IABs sell access to compromised networks, allowing ransomware gangs to concentrate their efforts on utilizing this initial access to launch their attacks. This specialization emerged alongside the introduction of ransomware-as-a-service (RAAS) by organized crime.<\/p>\n
After gaining initial access, Black Basta possesses a range of tools at their disposal, such as employing MimiKatz, QakBot stealer, and other techniques. Additionally, Black Basta has been observed installing and utilizing Cobalt Strike and Beacon. Cobalt Strike serves as the command and control application, while Beacons refer to callback sessions from the targeted systems. These Beacons serve as the standard malware payload used by Cobalt Strike to establish a connection with the team server.<\/p>\n
As the attack chain unfolds further Black Basta disables antivirus products and can run an encryption payload using Powershell. The subsequent execution of Black Basta\u2019s encryption module uses a broad variety of random filenames to escape detection by endpoint detection and response (EDR) products.<\/p>\n
It should be noted that Black Basta has been observed to have taken specific steps to disable DNS services on compromised systems to impede the recovery process by preventing it from accessing the internet and deploying a ransomware variant that specifically targets Linux-based VMware ESXi virtual machines (VMs)1<\/sup>.<\/p>\n This is detailed TTP data2<\/sup> using MITRE ATT&CK to describe the typical Black Basta attack chain:<\/p>\n