Fraud Management & Cybercrime
,
Ransomware
Defunct Ransomware Group’s Diaspora Includes Hackers With Focus on Microsoft Teams
Leaked data from ransomware groups continues to highlight how attackers target, infiltrate and amass new victims.
See Also: OnDemand | Navigate the threat of AI-powered cyberattacks
Recent leaks include a Feb. 11 dump of 200,000 internal Black Basta chat messages by “ExploitWhispers,” allegedly a former member of the group, and the May 7 dump of a SQL database from LockBit containing chat messages, victims details and Bitcoin wallet addresses.
Based on intelligence gleaned from its ongoing analysis of the Black Basta leaks, ReliaQuest recommends all organizations block the use of personal Google accounts on company-owned devices, educate users to spot the latest types of email and Microsoft Teams phishing attacks, and monitor for unauthorized use of Python, which attackers often use after a successful Teams phishing attack.
That’s based in part on Black Basta’s leader, in the leaked chats, having referenced two members of the Exploit cybercrime forum, SebastianPereiro and marmalade_knight, apparently to direct his employees to either connect with them or emulate what they were doing. “SebastianPereiro was linked to discussions about a Microsoft Teams zero-day, while marmalade_knight contributed to conversations on brute-forcing tool configurations,” ReliaQuest said.
Two other Exploit accounts that regularly interacted with those users appeared to be former members of Black Basta’s initial access team. One specializes in mimicking IT help desks, and recently “sought access to partner.microsoft.com accounts and the source code for a remote-access trojan (RAT) from other forum members,” and also ran a phishing campaign designed to steal session tokens for Google accounts, which can be used to bypass multifactor authentication defenses and remotely log into such accounts.
Attackers who seek Microsoft partner account email addresses – and to a lesser extent onmicrosoft.com addresses – typically do so to run phishing campaigns that can more reliably impersonate legitimate domains. “This tactic increases the likelihood of successful Teams phishing attacks against end users,” ReliaQuest said.
The other Exploit user the firm’s researchers traced “specializes in search engine optimization poisoning to drive traffic to malicious sites” and was seeking a developer to create a custom builds of the SmokeLoader Trojan, which attackers often use to to infect and remotely control systems and to exfiltrate data (see: Russian SmokeLoader Campaign in Ukraine Uses 7-Zip Zero-Day).
ReliaQuest said ransomware groups regularly use SEO poisoning to send victims to sites that contain such malware, disguised as plausible-looking software. “For example, terms like ‘court case’ can target legal teams, while ‘printer troubleshooting’ can be aimed at IT staff, infecting their machines through compromised webpages,” it said.
The leaked Black Basta chats reveal the group’s leader was an individual named Oleg Nefedov, who’s been tied to such aliases as Trump/Tramp, GG and AA. He was no ransomware spring chicken: “The messages indicate Nefedov was an active member in Revil and Conti and is protected by high-ranking Russian political figures and the FSB and GRU agencies,” says a report from Barracuda.
Black Basta was along the same lines as Conti, replete with salaries, office space, Christmas parties, and a diverse workforce that included ransomware campaign managers, intrusion specialists and developers who kept refining its crypto-locking malware. At one time, the group posted 50 new non-paying victims to its data-leak site every month (see: Leaked Chat Logs Reveal Black Basta’s Dark Night of the Soul).
After months of decline, Black Basta now appears to be defunct. But security experts say the operators and affiliates involved in ransomware continue to move between different operations – or work solo – and regularly tap a vast ecosystem of partners and former accomplices.
Affiliates of Black Basta are likely already working with newer groups such as 3AM, which is “taking pages from Black Basta’s playbook – particularly its signature phishing tactics,” or Cactus, given that the leaked chats showed Trump remitted a $500,000 to $600,000 payment to the group, suggesting a close working relationship, ReliaQuest said.
Or they might be working with another group that’s claimed many more victims in recent months, which was called “Eldorado” until recently rebranding as “Blacklock,” suggesting it might be continuing Black Basta’s morally bankrupt legacy.
As the apparent implosion of Black Basta demonstrates, even successful crime groups that amassed millions in ransom payments don’t last forever, at least in name. Reports of individuals burning out due to stress are not uncommon.
Law enforcement turning up the heat on such groups has helped to disrupt not only those operations, but the larger cybercrime community.
Evidence of this comes in part through ransomware groups appearing to resort to tactics they would never have previously entertained. That includes the once high-flying LockBit group. Its apparent head of operations remains at large in Russia but Western law enforcement last year continued to severely disrupt operations, including infiltrating the group’s infrastructure, obtaining decryption keys for victims and intelligence on affiliates, as well as arresting some suspects, including an alleged key developer.
Security experts say the recent leak of LockBit data shows that its current affiliates are unsophisticated, compared to the hacking talent the group previously commanded. By choice or due to a lack of oversight, the new affiliates appear to be playing by their own rules, which has included such previously verboten behavior as hitting targets in China, as well as Russia. LockBit’s leadership has attempted to laugh off the latter as being the work of the FBI. Whether that generates a date with defenestration at the hands of Kremlin lackies remains to be seen (see: LockBit’s New Reality Is Out of Control Affiliates).
For ransomware groups, the perils – and thus desperation – appear to be mounting. At the same time, their ability to access and work with a network of specialists who continue to refine innovative new types of attacks means such groups very much remain a threat.