BlackLock Rises, ‘Fatigued’ Black Basta Declines

Ransomware groups whose names are variants of “black” are having a mixed few first months of the new year. Attacks tied to BlackLock have been surging, while the long-running Black Basta looks set to disband, even if it remains a current threat.

See Also: Live Webinar | Thrive in Chaos: How to Get Your Minimum Viable Company Back Online

The BlackLock ransomware-as-a-service operation, first seen in March 2024, builds ransomware to infect Windows, VMWare ESXi, and Linux systems, said cybersecurity firm ReliaQuest.

Also known as El Dorado or Eldorado, BlackLock practices double extortion, so it steals data from victims before encrypting their systems, demanding a ransom for a decryptor and for a promise to not publish stolen data. BlackLock’s data-leak site lists fourteen times as many victims during the last three months of last year as it did the preceding three months, ReliaQuest said.

Ransomware groups regularly lie, including about the identity and quantity of victims. Even so, any surge in BlackLock-perpetrated attacks suggests the nascent group is growing quickly.

The quality of ransomware groups’ malware is one factor that leads some to amass more victims than others. The Play, Qilin and BlackLock operations are among the current groups that maintain their own, custom crypters. Top tier players have historically done this to make their lockers tougher to detect and to attract the best affiliates by claiming their malware is faster and stealthier than the competition.

Such groups stand in contrast to the likes of Bl00dy, Dragonforce and RA World, which all “rely on leaked Babuk or LockBit builders to launch attacks,” said Jim Wilson, a cyberthreat analyst at ReliaQuest. Such groups may lack technical knowledge or be unable to afford top-tier development talent. The upside for defenders is that they can study the underlying code, and oftentimes craft targeted defenses.

BlackLock’s cybercrime underground presence has flourished in recent months. Wilson said BlackLock regularly posts on the Ramp cybercrime forum using “$$$” as a handle to recruit fresh affiliates, initial access brokers and high-level programming and development specialists. The group regularly advertises for “traffers” – hackers who are able to direct victims to malicious sites before handing off the attack to more experienced members of the operation.

Incident response firms say phishing attacks and compromising remote-access tools are the most common ways that ransomware groups gain initial access to victim’s environments, followed by exploiting known software vulnerabilities.

Top-flight groups often seek fresh approaches to these strategies. On Jan. 28, $$$ solicited on Ramp hackers with the skills needed to abuse Microsoft’s Entra Connect Sync, which synchronizes changes between Active Directory and Entra, formerly known as Azure Active Directory.

The post referenced December 2024 research from SpecterOps detailing how attackers could potentially abuse Entra’s synchronization capabilities by adding their own Window Hello For Business – aka WHFB – key to a user’s account. Whether or not such attacks come to pass remains to be seen.

Black is Black

The rise of BlackLock comes at the same time as other groups appear to be on the decline.

In particular, Black Basta, which spun off from the notorious Russian-speaking REvil and Conti operations, appears to be getting closer to disbanding, said Yelisey Bohuslavskiy, partner and chief research officer at threat intelligence firm RedSense.

One of the group’s challenges has apparently been finding a suitable replacement for the Qbot, aka Qakbot, malware that it relied on until Western law enforcement disrupted Qbot in August 2023. He said the group attempted to shift from having a botnet-driven focus on malware distribution to executing carefully planned social engineering campaigns.

Cybersecurity firm Rapid7 reported seeing Black Basta refine its social engineering attack techniques in several waves last year, each time adding “new malware payloads, improved delivery and increased defense evasion.”

These social engineering attacks included the group “sending lures via Microsoft Teams,” with operators many times pretending to be on the IT team, sometimes as part of the help desk or customer support group.

If potential victims interacted, the operator’s next step oftentimes featured them trying to trick the user into installing a remote management tool – such as AnyDesk, Level, QuickAssist, ScreenConnect or TeamViewer – or else sending them a malicious QR code, or attempting to create a reverse shell with system using the OpenSSH client, Rapid7 said.

Based on cases it investigated, Rapid7 said that if the attackers gained access to a victim’s system, their next move would typically be to install either Zbot or DarkGate malware, both to load additional malware as well as “to quickly enumerate the environment and dump the user’s credentials.” Top targets included VPN credentials as well as any active multifactor authentication tokens, to help the attacker potentially bypass MFA. After that, attackers would typically attempt to gain access to the wider environment, steal data and deploy crypto-locking malware, it said.

One such attack, investigated by ReliaQuest last December, started with “a flood of spam emails” being sent to over 15 employees from the Microsoft lookalike URL onmicrosoft.com – branded to appear to be legitimate – that left users unable to access email, said John Dilgen, a cyberthreat intelligence analyst at ReliaQuest.

Pretending to be a help desk employee, “the threat actor then used Teams to call at least two users and convinced them to open the remote-access tool Quick Assist, join a remote session and grant control of their machines,” Dilgen said.

After accessing Quick Assist – built into Windows – he said that within 7 minutes, the attacker installed software on the endpoint that made it begin to communicate with the attacker’s command-and-control server, and achieved a “breakout time” – meaning they began moving literally in the targeted environment – after just 48 minutes in total. Ultimately, the attacker successfully exfiltrated data from the manufacturing sector victim, he said.

Despite such recent attacks, based on “deep and dark web intelligence sources,” RedSense’s Bohuslavskiy said that since early last summer, key players in Black Basta have been displaying “signs of fatigue with ransomware operations,” after having been involved in such attacks since 2019 or 2020.

“Even the admin, who played a critical role in holding the team together, was reportedly losing interest in the business,” he said, adding that the group’s previous targeting suggested it might have close ties to the Russian government (see: Is Russia Reining In Ransomware-Wielding Criminals?).

While Black Basta appears to be bowing out, and many of its affiliates will likely get recruited by other operations, the group itself continues to pose a threat. “They are still operating servers, negotiating with victims and deploying poorly maintained lockers,” Bohuslavskiy said. “Their decryption often fails, as they have become increasingly careless. This negligence makes them even more destructive.”