Fraud Management & Cybercrime
,
Ransomware
After Disrupting Ascension Health, Black Basta Forecast Reprisals From FBI, Moscow
Combing through leaked ransomware group chats, I didn’t expect to see members of Black Basta debating the ethics of their targeting, including amassing healthcare victims.
See Also: The Comprehensive Guide for a Viable BYOD Policy
Of course, self-reflection among criminals only goes so far: The leaks don’t show anyone foreswearing the hacking life or, say, donating their stolen money to orphanages.
Members of the ransomware-as-a-service group mainly seemed worried about the optics of targeting healthcare institutions and provoking a response from Western law enforcement or even a crackdown by Russian authorities.
Black Basta’s leaked chat logs suggest the Russia-speaking criminal operation succumbed to fears about potential repercussions and gave Missouri-based Catholic hospital chain Ascension Healthcare a “free” decryptor after cryptolocking its systems in May 2024.
It should go without saying: Don’t ever count on the human side of criminal extortionists. Being a sociopath might not be mandatory for joining a ransomware group, but it doesn’t seem to hurt. A good illustration is BlackCat, aka Alphv, which leaked photos of breast cancer patients stolen in February 2023 from Lackawanna County-based Delta Medix Group after the victim refused to pay.
The Black Basta attack on Ascension, which operates 140 hospitals and 40 senior care facilities in 19 states plus the District of Columbia, led the hospital chain to deactivate multiple IT systems, including electronic health records, for multiple weeks. Widespread disruption ensued.
A Black Basta hacker with the handle “Tinker” opened negotiations with Ascension on May 9, 2024, after telling colleagues he expected to shake it down for tens of millions of dollars, if not $100 million or more, based on Change Healthcare’s reported $22 million payoff to BlackCat (see: Leaked Black Basta Chat Logs Show Banality of Ransomware).
The criminals closely monitored news sites, tracking the fallout, including doctors detailing on Reddit serious risks to patient safety and care that resulted, including the suffering endured by seriously ill patients facing delays in being transferred to palliative care.
In internal chats, group member “gg,” who said he’d hacked the hospital chain, “appeared to feel bad about the attack and concerned that cancer patients were suffering,” said Will Thomas, threat hunting program lead at the digital infrastructure company Equinix’s Threat Analysis Center, in a Thursday blog post – although it was “hard to tell if they are serious or being sarcastic,” at least at first.
As news of the attack’s repercussions intensified, gg shared machine translations of English-language news stories and appeared to have a change of heart. “We are pentesters, not murderers,” he told colleagues. “If children or cancer patients get hurt, how can I live with it?”
Members of the group debated giving Ascension a free decryptor while still demanding a ransom for a promise to delete 1.4 terabytes of stolen data, which the group claimed amounted to three terabytes.
Putting his foot down, gg said he’d called a meeting at the office, and the group was changing tack. “Never again,” he said. “Don’t give me anything like that,” apparently swearing off attacking hospitals.
The group could afford to be choosey. Black Basta earned millions in ransom payments after spinning off from Russian group Conti in April 2022. By November 2023, blockchain analytic firm Elliptic and Corvus Insurance jointly traced “at least $107 million in Bitcoin ransom payments” to the group.
One problem even when groups give a so-called free decryptor to a victim – as the Conti ransomware group did in May 2021 for Ireland’s state-run health services provider, the Health Service Executive – is that it’s not a magic wand. Systems have already been disrupted, and organizations hit by ransomware face a long road to recovery. Even if they have perfect backups in place, hardware must first be wiped; restoration at scale takes time.
For Ascension Health, the change of heart by Black Basta – itself a spinoff of the pro-Putin Conti group – only came after a serious amount of damage was done, which took months to repair. The hospital chain notified nearly 5.6 million current and former patients and employees that the attack and resulting data breach potentially compromised their sensitive information.
Keep Focusing on Defense
The Ascension Healthcare attack is a reminder that having a strong defense remains the best strategy against ransomware attacks, either to block them outright or to stop them as quickly as possible, before attackers can steal data or crypto-lock systems.
Black Basta appears to have spent about six months in Ascension’s network after obtaining access credentials for 14 employees around Nov. 3, 2023. By May 8, 2024, after exfiltrating 1.5 terabytes of data, attackers unleashed version 4.0 of their malware, infecting 12,000 endpoints after abusing Windows safe mode to bypass endpoint defenses, Thomas said.
Law enforcement and security experts have long urged victims to never pay a ransom, at least for anything intangible, such as criminal promises. Doing so incentivizes attackers, leading to more victims, especially in sectors such as healthcare following Change paying a massive sum.
One bright spot in the Black Basta chat logs is seeing a group that realizes the enormity of what it’s done by disrupting a major U.S. healthcare provider and thinks it’s overstepped.
That’s thanks in part to Western law enforcement having increased the tempo of its counter-ransomware operations and embraced tactics such as naming and shaming Russia-based ransomware operators and attempting to freeze their assets, including cryptocurrency (see: Europol Details Pursuit of LockBit Ransomware Affiliates).
Black Basta discussed the likelihood of reprisals, pointing to the FBI takedown of TrickBot. They worried about being branded as terrorists – and added to a sanctions blacklist – if patients died. They discussed the fallout over the Colonial Pipeline attack and how it dominated the 2021 U.S.-Russia summit, derailing Russian President Vladimir Putin’s desired focus on Ukraine. Not long after, Moscow arrested multiple ransomware practitioners.
Black Basta member “nickolas” recommended going further than giving Ascension a free decryptor and deleting its data. Expecting law enforcement retaliation, including attempts to infiltrate and disrupt the operation, he recommended they immediately audit the entire infrastructure and “change everything possible,” including “connection routes, servers,” and the data leak site, as well as rebrand the operation under a new name, the chats reveal.
“As practice shows, rebranding generally works quite well,” he said.
There’s the crux. Even though security experts report Black Basta has been on the decline since shortly after it hit Ascension, owing in part to operators’ burnout, the ransomware ecosystem shows no signs of stopping anytime soon, aided so far by Russia’s inability or unwillingness to jail Russian cybercriminals and history of never extraditing citizens to face foreign charges.
Known ransomware profits in 2024 declined from 2023 but still amounted to $655 million, according to blockchain analytics firm Chainalysis.
With those profits and belated ethical discussions about the impact on vulnerable victims, crocodile tears come cheap.