In a recent joint report by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), a new ransomware gang named Black Basta has been identified as breaching over 500 organisations globally between April 2022 and May 2024. This group has targeted various sectors, including healthcare, spanning across North America, Europe, and Australia.
Black Basta, coming through as a Ransomware-as-a-Service (RaaS) operation in April 2022, has quickly gained notoriety by attacking numerous high-profile victims such as Rheinmetall, Hyundai, Capita, and the American Dental Association, among others. Believed to have connections to the former Conti cybercrime syndicate, Black Basta operates with sophistication and a steady stream of initial access to its targets.
One of the key tactics employed by Black Basta involves stealing corporate data before encrypting a company’s devices. This stolen data is then used in double-extortion attacks, where victims have demanded a ransom to prevent the publishing of their sensitive information. The gang’s data leak site, ‘Black Basta Blog’ or ‘Basta News,’ lists victims and progressively releases data to pressure them into paying the ransom.
Technical analysis reveals that Black Basta utilises the ChaCha20 encryption alg
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.