RansomwareATT&CK S1070
Black Basta
Black Basta is a ransomware-as-a-service variant first identified in April 2022. The May 2024 joint advisory reported that its affiliates had affected more than 500 organisations, including critical infrastructure and healthcare, gaining access through spearphishing, loaders such as QakBot and exploitation of known vulnerabilities.
- Public attribution and associated actors
- Run as ransomware-as-a-service; MITRE ATT&CK lists the software as used by Storm-1811.As publicly reported:Black BastaStorm-1811
- First seen
- Around 2022
- Platforms
- Windows, VMware ESXi
- MITRE ATT&CK software entries
- S1070 Black Basta
How it spreads or gets in
- Spearphishing, QakBot infections and exploitation of known vulnerabilities (CISA AA24-131A).
- Later campaigns reportedly used phone and chat social engineering posing as IT support.
Key behaviours
- Used PowerShell and WMI for execution and discovery.
- Created services for persistence and could reboot into Safe Mode before encrypting.
- Encrypted files, deleted shadow copies and changed the desktop wallpaper.
ATT&CK techniques
- T1566Phishing
- T1059.001Command and Scripting Interpreter: PowerShell
- T1047Windows Management Instrumentation
- T1543.003Create or Modify System Process: Windows Service
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
- T1491.001Defacement: Internal Defacement
- T1529System Shutdown/Reboot
Selected from the family's MITRE ATT&CK software entry, plus initial-access techniques named in the cited advisories.
Detection ideas
- Treat QakBot detections as a precursor to ransomware.
- Alert on unsolicited remote-support sessions started after a phone call or chat.
- Detect boot configuration changes that force Safe Mode.
Defences that work
- Train staff to verify unsolicited IT support contacts out of band.
- Restrict which remote-support tools may run.
- Patch known exploited vulnerabilities quickly.
- Keep offline, tested backups.