Black Basta

Also known as: Storm-1811, Cardinal

Overview

Ransomware group believed to include former Conti members. Known for using Microsoft Teams social engineering and Quick Assist for initial access. Targets large enterprises.

MITRE ATT&CK Coverage

Recon
Res Dev
Init Access
Execution
Persistence
Priv Esc
Def Evasion
Cred Access
Discovery
Lat Move
Collection
C2
Exfil
Impact
3 of 14 tactics observed

Raw TTPs

Teams Social EngineeringQuick Assist AbuseRansomwareDouble ExtortionQakbot Distribution

Related Intelligence (2)

HIGHRansomware

Be on the lookout for Mistic, a new backdoor used by ransomware broker

Researchers have identified a new backdoor program that has been used in enterprise intrusions since April and appears to be linked to an initial access broker that sells network footholds to ransomware gangs. Dubbed Mistic by researchers from Symantec , the malware program has been deployed on networks belonging to organizations from multiple sectors, including insurance, education, IT, and profe

CSO Online
HIGHRansomware

New ‘Mistic’ RAT Opens Door to Several Ransomware Families

Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. The post New ‘Mistic’ RAT Opens Door to Several Ransomware Families appeared first on SecurityWeek .

SecurityWeek