Ransomware - Black Basta

Black Basta made headlines beginning in April 2022 when researchers began publishing articles on the emergence of the group and its associated ransomware. At the same time, their dark web double extortion website was uncovered, showing around a dozen victims. It's difficult to tell the dates of when these victims were breached, considering the first compilation dates of the ransomware began in mid-February under a different name - "no_name_software" - which means there was about a two-month buffer between the ransomware's creation and its discovery. Even though the ransomware was unnamed at the time, it shared practically the same characteristics as the first official iteration of Black Basta, which, based on the compilation dates, did indeed appear around April 2022.

Coincidentally, February 2022 was the same month the Conti ransomware chats and encryptor builder were leaked by a disgruntled Ukrainian hacker after the Conti group publicly expressed support for Russia at the beginning of the Russia-Ukraine war. Researchers believe that Black Basta comprises former Conti members (Wizard Spider) and some REvil members (Carbon Spider) based on the source code and tools used to breach networks. However, the compilation dates of the Basta encryptor happened before the Conti leaks. The first compilation date of Black Basta was on February 17, 2022, under the "no_name_software" alias, and the Conti leaks officially occurred on February 27, 2022. So, one could assume that this ransomware began before the dissolution of Conti. One thing is for certain: Black Basta is a derivative of Conti. To be specific, the encryptor leveraged the Conti v2 builder.

The group is believed to contain members of Wizard Spider and Carbon Spider, but since Black Basta is a RaaS (Ransomware-as-a-Service), there are affiliates who leverage the ransomware and share the profits with the group. For example, it is known that several Black Basta breaches began from a QakBot (QBot) email phishing campaign. The QBot malware has been attributed to at least two groups, GOLD CABIN and GOLD LAGOON. However, it's possible that these two groups are closely related. At least their intentions are - money. Microsoft also reported on another group that is an affiliate of Conti and, subsequently, Black Basta. That group's name is dubbed Storm-0506. The WatchGuard Threat Lab believes there are more groups utilizing Black Basta, but we haven't been able to make any more tangible attributions.

Based on their extortion website and public reporting, Black Basta has hundreds of victims and was responsible for at least 200 victims within their first year. However, they have much more than that. The only common denominator between the victims is that they are all from Western countries. For example, the United States is the group's top target, followed by Germany, Canada, the United Kingdom, Italy, Switzerland, and Austria. There have been no known victims from Asia, Africa, or the CIS (Commonwealth of Independent States). As for industry sectors, the most observed targets come from Manufacturing, Construction & Architecture, Retail & Wholesale, and Professional Services. However, there’s no clear pattern among industry sectors.

The WatchGuard Threat Lab found around 100 samples of Black Basta, with entries including the “no_name_software” alias and official Black Basta samples, and they even created a few Linux encryptors for VMWare ESXi systems. All of the samples drop a ransom note titled “readme.txt” and include information on communicating and negotiating with the operators on a dedicated TOR website. The ransom note includes a unique ID for each victim that is used to enter the negotiation chat. Based on public reporting, the group demands extortion amounts in the hundreds of thousands of dollars to millions, depending on each victim. The file extension used for encrypted files is “.basta,” and the files are encrypted with a combination of ChaCha20 and RSA-4096. The ChaCha20 stream cipher encrypts the file contents, and then the ChaCha20 key is encrypted with an RSA-4096 hardcoded public key. Towards the end of 2022, the group updated the Black Basta encryptor, which is titled Black Basta v2, and the details for that are included in the Black Basta v2 entry within the Ransomware Tracker.