After gaining initial access through compromised edge devices, Black Basta actors follow a structured attack chain deploying post-exploitation frameworks like Cobalt Strike or Brute Ratel to establish command-and-control channels, extract credentials, and ultimately deploy ransomware payloads that encrypt network shares, virtualized environments, and cloud storage. The analysis of the BRUTED framework revealed sophisticated capabilities targeting various remote-access and VPN solutions including SonicWall NetExtender, Palo Alto GlobalProtect, Cisco AnyConnect, Fortinet SSL VPN, Citrix NetScaler, Microsoft RDWeb, and WatchGuard SSL VPN. This offensive framework, named “BRUTED” based on its log naming conventions, performs automated internet scanning and credential stuffing against edge network devices, including widely used firewalls and VPN solutions in corporate networks. According to the leaked communications, Black Basta operated multiple servers dedicated to brute-force attacks, including 45.140.17.40, 45.140.17.24, and 45.140.17.23, all registered under Proton66 (AS 198953) and located in Russia. Analysts at EclecticIQ identified a previously unknown brute forcing framework that Black Basta RaaS members have used since 2023. A Russian-speaking actor using the Telegram handle @ExploitWhispers leaked internal chat logs of Black Basta Ransomware-as-a-Service (RaaS) members on February 11, 2025. These communications, spanning from September 2023 to September 2024, have provided security researchers with unprecedented insight into the group’s operational tactics and infrastructure used to target organizations across multiple sectors. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Black Basta, which emerged in April 2022, has established itself as a sophisticated financially motivated cybercrime operation using double extortion tactics. The group has demonstrated a strategic focus on high-value targets where downtime creates significant financial and operational impact, with Business Services (33 incidents), Industrial Machinery (14), and Manufacturing (6) being their most frequently targeted sectors.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Mar 2025 15:40:05 +0000