Researchers released a decryptor to help the numerous victims of one of 2023's most prolific double-extortion ransomware gangs, Black Basta, restore their compromised files for free.
Black Basta is believed to have attacked well over 300 organizations since it was first observed in early 2022, making it one of the top most active malware strains by victim count over that period.
The gang is believed to have raked in at least $107 million in ransom payments from over 90 victims.
The tools enable security teams to analyze files encrypted by the gang to determine if they are recoverable.
If they are, other tools in the suite assist with the decryption process.
SRLabs' GitHub documentation explains that Black Basta's ransomware uses a ChaCha keystream that XORs 64-byte-long chunks of the files it encrypts.
Researchers regularly develop decryptors after discovering flaws in threat actors' malware.
Victims' success in recovering lost data using decyptors can vary depending on the circumstances.
An unfortunate downside of decryptors being published is that it alerts ransomware gangs to the need to upgrade their encryption techniques, potentially making it harder for future victims to retrieve compromised files.
As a double-extortion malware gang, Black Basta specializes in exfiltrating sensitive data from victims before encrypting their networks and threatening to publish the stolen information if a ransom isn't paid.
Black Basta is widely believed to be an offshoot of another prolific ransomware operator, the Conti Group, which disbanded in 2022.
Its victims in 2023 included Swiss technology giant ABB, British outsourcing company Capita, and Dish Network.
The gang's ransomware was commonly deployed using Qakbot malware.
Qakbot's botnet was taken down by authorities last August, although the malware resurfaced in December.
Researchers believe the Qakbot takedown could explain a marked reduction in Black Basta attacks during the second half of 2023.
They didn't stop completely with the gang's victims in the later part of the year including major TV advertising sales and technology firm Ampersand, and Toronto Public Library, Canada's largest public library system.
This Cyber News was published on packetstormsecurity.com. Publication date: Thu, 04 Jan 2024 13:43:05 +0000