Fraud Management & Cybercrime
,
Ransomware
Group Cross-Referenced Open-Source Victim Intelligence With Infostealer Hauls
A leak of 200,000 internal Black Basta chat messages provides an overview of how a modern ransomware group organizes itself to take down victims and uses a variety of tactics that should be, in theory, easy to repel.
See Also: The Comprehensive Guide for a Viable BYOD Policy
Black Basta conducted extensive research and shared copious notes documenting targets of interest while cataloging attempts to steps to reach the target, including through social engineering attempts, said Milivoj Rajić, head of threat intelligence at DynaRisk. “They often target multiple people within a single organization,” he told Information Security Media Group.
The corpus of Russian-language messages was leaked on Feb. 11 by Telegram user “ExploitWhispers,” who claimed the dump was in reprisal for the ransomware group targeting Russian banks. Multiple security researchers said the chats appear to be legitimate, based on their correlation with known events and facts. The group appears to be close to collapsing (see: Ransomware: BlackLock Rises, ‘Fatigued’ Black Basta Declines).
The leaks show the group actively testing networks with data harvested using information stealing malware, Rajić said. Infostealers exfiltrate batched data known as a log that typically includes passwords, multifactor authentication tokens to help attackers bypass multifactor authentication and saved browser passwords.
“They have a strong focus on exploiting VPN vulnerabilities. They actively seek out, purchase or find individuals who can provide these types of exploits,” he said. Such efforts inside Black Basta were led by an employee who used the handle “Nur,” the leaked chat logs show.
Top targets appeared to not be random. Black Basta prioritized financial services firms, suppliers of industrial materials for manufacturing and electrical firms. Unlike some ransomware groups that pursue targets of opportunity, Black Basta appeared to focus on more specific sectors.
The leaks also highlight the humdrum, everyday existence for a ransomware group, oftentimes reading “more like threat gossip” than threat intelligence, in the words of one security engineer who’s studied the leaks (see: Leaked Black Basta Chat Logs Show Banality of Ransomware).
Members – no surprise – themselves weren’t workplace saints. While some debated the ethics of unleashing crypto-locking malware, “one of the hackers got caught lying about his work progress by his boss,” claiming a task was done when logs showed they hadn’t wrapped it up, said Alon Gal, co-founder and CTO at threat intelligence firm Hudson Rock. His firm used the leaks to train an instance of ChatGPT and has made this BlackBastaGPT tool freely available.
Based on the work of researchers such as Rajić and Thomas Roccia, as well as BlackBastaGPT, the leaks highlight how members of Black Basta appeared to have used a variety of open-source intelligence to guide their efforts. This included the commercial search engine ZoomInfo, plus LinkedIn and people search site RocketReach, to identify a potential victim’s annual profits and employees to target, which they often did via fake download links, social engineering or phishing emails.
For many of the targets Black Basta researched, the group also had remote-access credentials, suggesting that the group used ZoomInfo and other tools to prioritize which organizations to try and hit first.
One frequent strategy involved attempting to trick victims into installing remote management and monitoring software from Level.io, sometimes disguised as an anti-spam tool, or installing it after breaching the network, sometimes via PowerShell, at least according to BlackBastaGPT.
The group documented test results from a probe of network security and recorded internet-facing devices and their vulnerabilities, including if two-factor authentication controls were in place, as well as the presence of services such as remote desktop protocol. For this, the group looked for internet-connected devices with known vulnerabilities inside organizations using a variety of tactics, including through Internet of Things search engines Shodan and Censys, as well as using common search engines to search for known signs of security vulnerabilities, a tactic known as Google Dorking.
A list of “Dorks” circulated among Black Basta members includes the results search of a search for a Linux vulnerability that has revealed a specific vulnerable organization, which reports that it gives “root, admin or system” level privileges.
Black Basta hackers doubled down on whatever might work. The leaks mention 29 specific vulnerabilities tracked by their CVE designation – ranging in age from 2017 to 2024, of which 13 rate as critical, meaning they can be remotely exploited to run arbitrary code on a vulnerable system, Rajić said.
The oldest referenced vulnerability – rated important – was CVE-2017-11882, a memory corruption flaw in Microsoft Office 2016 and earlier that attackers can exploit to run arbitrary code.
Other highly referenced CVEs mentioned by the group included vulnerabilities in Apache – Log4j, F5 BIG-IP devices, Confluence servers and Data Center injection vulnerability, GitLab, Juniper devices, Microsoft Exchange Server, Microsoft Outlook, Netlogon remote protocol (MS-NRPC), Spring Framework and Zyxel firewalls, among others.
Rajić said age-old guidance about maintaining a variety of layered defenses continues to apply. That includes training users to avoid untrusted software and links from suspect sources. At an organizational level, keep all software up to date, monitor for attack attempts using intrusion prevention systems, give users the least level of access privilege possible and proactively scan for vulnerabilities before attacks can find them. Two-factor authentication also appears to have blunted Black Basta’s attacks – at the least, shunting them to a more high-touch method such as social engineering.
While this advice might sound simple, in too many cases it simply doesn’t appear to have been getting done by victim organizations. As ransomware groups’ attacks continue, don’t make their jobs any easier for them.