Start your day with intelligence. Get The OODA Daily Pulse.

Subscribe Sign In

Home > Analysis > The Social Engineering Tactics of Ransomware-as-a-Service Operator Black Basta

The Social Engineering Tactics of Ransomware-as-a-Service Operator Black Basta

05/14/2024 | Written by: Daniel Pereira

Last week: another high-impact ransomware attack in the healthcare sector, this time on Healthcare Giant Ascension. The attack has been attributed to a Russian non-state actor Black Basta – a “group…believed to have been started by former members of the infamous Conti ransomware collective, which dissolved in May 2022. Since then, Black Basta and its affiliates have hit over 500 organizations around the world, predominantly in North America, Europe, and Australia. Details here.

Who is Black Basta?

“Unlike some ransomware groups, Black Basta does not outright define the ransom amount to be paid. Instead, they tell the victim to contact them via a specified .onion URL to negotiate it.”

As reported by HelpNetSecurity:

The Russian-speaking Black Basta group is believed to have been started by former members of the infamous Conti ransomware collective, which dissolved in May 2022. Since then, Black Basta and its affiliates have hit over 500 organizations around the world, predominantly in North America, Europe, and Australia.
They target businesses and organizations in critical infrastructure sectors (including healthcare).
In late 2023, Elliptic and Corvus Insurance pinpointed “at least $107 million in Bitcoin ransom payments to the Black Basta ransomware group since early 2022,” and said that blockchain transactions form a clear link between Black Basta and Conti.

Thursday, May 9th: Catholic health system Ascension warns of disruptions following cyberattack

From our friends over at Recorded Future: “One of the largest Catholic health systems in the U.S. is dealing with a disruption to its clinical operations following a cyberattack detected on Wednesday. Ascension, a nonprofit organization that runs 140 hospitals across 19 states, published a notice saying it discovered unusual activity on network systems and immediately began an investigation, hiring Mandiant and notifying law enforcement soon after. Why it matters:

Ascension, one of the largest Catholic health systems in the U.S., is managing a disruption to its clinical operations due to a cyberattack, marking another significant incident in the healthcare sector. This indicates the increasing vulnerability and attractiveness of healthcare institutions to cybercriminals.
The impact of the cyberattack on Ascension is still under assessment, with potential data breach being a significant concern. This highlights the critical need for robust cybersecurity measures within large-scale healthcare systems to ensure the privacy and safety of patient data.
Given incidents such as this and the previous ransomware attack on UnitedHealth Group’s Change Healthcare, the American Hospital Association has urged Congress to enforce stronger cybersecurity strategies in healthcare. This suggests the need for legislative action and improved national defense against such cyber threats.”

Friday, May 10th: Healthcare Giant Ascension Hacked, Hospitals Diverting Emergency Service

Ascension, a non-profit that runs one of the largest healthcare systems in the United States, is scrambling to contain a cyberattack that is currently causing disruption and “downtime procedures” at hospitals around the country. Ascension has about 142,000 employees managing hundreds of hospitals and 40 senior living facilities across the United States. The healthcare giant said computer systems affected include electronic health records, the MyChart patient communication portal, certain phone systems, and systems used for ordering tests, procedures, and medications.

After Ascension Ransomware Attack, Feds Issue Alert on Black Basta Group

“Black Basta exploited a bug in ConnectWise’s ScreenConnect to enable secure remote desktop access and mobile device support.”

Also from Recorded Future:

Several U.S. government agencies warned that the Black Basta ransomware gang is targeting the healthcare industry and 12 of the 16 critical infrastructure sectors. In a Friday afternoon advisory, the FBI, Cybersecurity and Infrastructure Security Agency (CISA) and Department of Health and Human Services (HHS) said Black Basta has attacked at least 500 organizations globally between April 2022 and May 2024. Why it matters:

The Black Basta ransomware gang is posing a significant threat to the healthcare industry and critical infrastructure sectors, having attacked at least 500 organizations globally within a two-year timeframe. This not only brings to fore the sophistication of attacks but also the increasing danger posed to sectors central to societal functioning.
Web-based technology providers, like ConnectWise, are vulnerable to exploitation by ransomware gangs. In this case, Black Basta exploited a bug in ConnectWise’s ScreenConnect to enable secure remote desktop access and mobile device support. Affected sectors need to realize the importance of robust cybersecurity and vulnerability management to curb such exploitations.
Vital patient care services are compromised when healthcare organizations fall prey to these attacks; disruptions to patient care can lead to significant complications and delays in healthcare provision. The cited incident involving Ascension serves as a stark reminder of the critical need for elements of the health ecosystem to strengthen cybersecurity practices.

What Next?

Black Basta Target Orgs with New Social Engineering Campaign

Black Basta, one of the most prolific ransomware-as-a-service operators, is trying out a combination of email DDoS and vishing to get employees to download remote access tools.

Black Basta tactics, techniques, and procedures (TTPs) and Newest Initial Access Attempts

Rapid7 analysts have…shared the latest social engineering trick by the Black Basta operators: they spam targets’ inbox with junk email, then phone them posing as a member of their organization’s IT team, and offer assistance. They ask the target to install a legitimate remote monitoring and management tool (e.g., AnyDesk) or start Quick Assist, a built-in Windows remote support utility. If unsuccessful in their social engineering efforts with one target, they move on to the next.
“Once the threat actor successfully gains access to a user’s computer, they begin executing a series of batch scripts, presented to the user as updates, likely in an attempt to appear more legitimate and evade suspicion,” the analysts noted.
The scripts establish persistence, establish a reverse shell connection to a specified C2 server, harvest victim’s credentials from the command line using PowerShell.
“In most of the observed batch script variations, the credentials are immediately exfiltrated to the threat actor’s server via a Secure Copy command (SCP). In at least one other observed script variant, credentials are saved to an archive and must be manually retrieved,” they also added.
“In one observed case, once the initial compromise was completed, the threat actor then attempted to move laterally throughout the environment via SMB using Impacket, and ultimately failed to deploy Cobalt Strike despite several attempts. While Rapid7 did not observe successful data exfiltration or ransomware deployment in any of our investigations, the indicators of compromise found via forensic analysis conducted by Rapid7 are consistent with the Black Basta ransomware group based on internal and open source intelligence.”
Rapid7 advised organizations to block all unapproved RMM solutions from executing within the environment and to have established channels and methods employees can use to contact their IT department (and report suspicious emails and phone calls).

Cybersecurity Advisory: #StopRansomware: Black Basta

Install updates for operating systems, software, and firmware as soon as they are released.
Require phishing-resistant MFA for as many services as possible.
Train users to recognize and report phishing attempts.

ADVISORY SUMMARY

Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the authoring organizations) are releasing this joint CSA to provide information on Black Basta, a ransomware variant whose actors have encrypted and stolen data from at least 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector.
This joint CSA provides TTPs and IOCs obtained from FBI investigations and third-party reporting. Black Basta is considered a ransomware-as-a-service (RaaS) variant and was first identified in April 2022. Black Basta affiliates have impacted a wide range of businesses and critical infrastructure in North America, Europe, and Australia. As of May 2024, Black Basta affiliates have impacted over 500 organizations globally.
Black Basta affiliates use common initial access techniques—such as phishing and exploiting known vulnerabilities—and then employ a double-extortion model, both encrypting systems and exfiltrating data. Ransom notes do not generally include an initial ransom demand or payment instructions. Instead, the notes provide victims with a unique code and instructs them to contact the ransomware group via a .onion URL (reachable through the Tor browser). Typically, the ransom notes give victims between 10 and 12 days to pay the ransom before the ransomware group publishes their data on the Black Basta TOR site, Basta News.
Healthcare organizations are attractive targets for cybercrime actors due to their size, technological dependence, access to personal health information, and unique impacts from patient care disruptions. The authoring organizations urge HPH Sector and all critical infrastructure organizations to apply the recommendations in the Mitigations section of this CSA to reduce the likelihood of compromise from Black Basta and other ransomware attacks. Victims of ransomware should report the incident to their local FBI field office or CISA (see the Reporting section for contact information).

For the full joint Cybersecurity Advisory (CSA), go to StopRansomware: Black Basta

OODA Almanac 2024: Cyber a Safe Haven for Attackers

Attacks in cyberspace seem to have no escalatory or deterrence consequences, especially in the realm of cybercrime as ransomware attacks doubled over the past year with increasing impacts on the global economy. In an era dependent on technology for advantage, the importance of developing novel approaches to cybersecurity issues can not be overstated.

The escalation of cyber threats, particularly ransomware, underscores a stark reality: our collective security posture must evolve with an urgency that matches the ingenuity of our adversaries. The doubling of ransomware attacks is not merely a statistic; it is a clarion call for a paradigm shift in how we conceptualize and implement cybersecurity measures. New concepts for how we jurisdiction attacks and disrupt the economic incentives of the attackers are required. We must also embrace a more proactive stance, integrating advanced technologies like artificial intelligence and machine learning to predict and preempt attacks before they occur. Furthermore, the convergence of cybercrime with nation-state tactics necessitates a more nuanced understanding of the threat landscape, where strategic defense and risk management become as critical as tactical responses.

The future of cybersecurity lies in our ability to outpace the adaptability of threat actors, ensuring that the defenses we construct are not only resilient but also intelligent, capable of learning from each attack to bolster our protective measures. This requires a commitment to continuous innovation and developing cybersecurity strategies that are as dynamic as the threats they aim to thwart. As we’ve seen, attackers often exploit the weakest link, which may not be within our own organizations but within our supply chains, turning trusted partners into potential vulnerabilities

Additional OODA Loop Resources

For further OODA Loop News Briefs and Original Analysis on these topics, go to:

Social Engineering Remains the Coin of the Realm for Ransomware Gangs (or APTs- Advanced Persistent Threats): We have been on the social engineering (aka Human Risk Management or Human Engineering beat for a while – providing resources to our readership and the OODA Network regularly. Those resources are compiled here for individuals or organizations who want to follow up on some of the ideas presented in the 60 Minutes segment. We encourage follow-up and reviewing your threat vectors and vulnerabilities vis a vis the social engineering threat. There are plenty of pragmatic implementation resources here – especially in the OODAcast conversations with OODA affiliates who are the experts on the social engineering threat), which are a call to action.

After the Impact of the Change/United Healthcare Ransomware Attack, HHS Bolsters Healthcare Cybersecurity Initiatives: The ransomware epidemic is starting to feel like one continuous incident report and a growing national security concern – not to mention the dormant “ghost in the machine” capabilities that have already been positioned in the U.S. internetwork (by nation-state and non-nation-state players alike) as part of a strategic plan for a larger act of cyber war in the future. Following is a tick-tick (no pun intended) of the recent Change/United Health Group attack, which has been attributed to the Russia-affiliated ALPHV/Blackcat ransomware group.

Cyber Risks

Corporate Board Accountability for Cyber Risks: With a combination of market forces, regulatory changes, and strategic shifts, corporate boards and their directors are now accountable for cyber risks in their firms. See: Corporate Directors and Risk

Geopolitical-Cyber Risk Nexus: The interconnectivity brought by the Internet has made regional issues affect global cyberspace. Now, every significant event has cyber implications, making it imperative for leaders to recognize and act upon the symbiosis between geopolitical and cyber risks. See The Cyber Threat

Ransomware’s Rapid Evolution: Ransomware technology and its associated criminal business models have seen significant advancements. This has culminated in a heightened threat level, resembling a pandemic in its reach and impact. Yet, there are strategies available for threat mitigation. See: Ransomware, and update.

Challenges in Cyber “Net Assessment”: While leaders have long tried to gauge both cyber risk and security, actionable metrics remain elusive. Current metrics mainly determine if a system can be compromised without guaranteeing its invulnerability. It’s imperative not just to develop action plans against risks but to contextualize the state of cybersecurity concerning cyber threats. Despite its importance, achieving a reliable net assessment is increasingly challenging due to the pervasive nature of modern technology. See: Cyber Threat

Recommendations for Action

Decision Intelligence for Optimal Choices: The simultaneous occurrence of numerous disruptions complicates situational awareness and can inhibit effective decision-making. Every enterprise should evaluate its methods of data collection, assessment, and decision-making processes for more insights: Decision Intelligence.

Proactive Mitigation of Cyber Threats: The relentless nature of cyber adversaries, whether they are criminals or nation-states, necessitates proactive measures. It’s crucial to remember that cybersecurity isn’t solely the responsibility of the IT department or the CISO – it’s a collective effort that involves the entire leadership. Relying solely on governmental actions isn’t advised given its inconsistent approach towards aiding industries in risk reduction. See: Cyber Defenses

The Necessity of Continuous Vigilance in Cybersecurity: The consistent warnings from the FBI and CISA concerning cybersecurity signal potential large-scale threats. Cybersecurity demands 24/7 attention, even on holidays. Ensuring team endurance and preventing burnout by allocating rest periods are imperative. See: Continuous Vigilance

Embracing Corporate Intelligence and Scenario Planning in an Uncertain Age: Apart from traditional competitive challenges, businesses also confront external threats, many of which are unpredictable. This environment amplifies the significance of Scenario Planning. It enables leaders to envision varied futures, thereby identifying potential risks and opportunities. All organizations, regardless of their size, should allocate time to refine their understanding of the current risk landscape and adapt their strategies. See: Scenario Planning

Track Technology-Driven Disruption: Businesses should examine technological drivers and future customer demands. A multidisciplinary knowledge of tech domains is essential for effective foresight. See Disruptive and Exponential Technologies.

Tagged: Healthcare Sector Ransomware ransomware attack

About the Author

Daniel Pereira

Daniel Pereira is research director at OODA. He is a foresight strategist, creative technologist, and an information communication technology (ICT) and digital media researcher with 20+ years of experience directing public/private partnerships and strategic innovation initiatives.