#blackbasta — Public Fediverse posts

Ransomware: математический аппарат на службе зла

Привет, Хабр! Я Илья Борисов, старший специалист отдела экспертизы MaxPatrol EDR антивирусной лаборатории Positive Technologies. В 2025 году команда аналитиков антивирусной лаборатории PT ESC провела исследование актуальных семейств ransomware (aka шифровальщиков), чтобы повысить эффективность их обнаружения нашим продуктом. Этот вид ВПО оказался одной из наиболее значимых и заметных разновидностей вредоносов, используемых в атаках в 2025 году. Мы проанализировали образцы, замеченные в период с конца 2024 года по конец 2025-го. Были разобраны как давно известные семейства шифровальщиков, такие как Black Basta, MedusaLocker и LockBit, и относительно недавно появившиеся Lynx, HellCat и BERT. В этой статье хочу поделиться результатами этого исследования. Для начала расскажу про типы шифровальщиков, на кого они нацелены, как работают, подсвечу технические детали, а также ретроспективно прослежу некоторые тенденции в эволюции ransomware.

https://habr.com/ru/companies/pt/articles/1039170/

#ransomware #шифровальщики #вредоносное_по #lockbit #blackbasta #ransom #вымогательство #выкуп #кибератаки

Ransomware: математический аппарат на службе зла

Привет, Хабр! Я Илья Борисов, старший специалист отдела экспертизы MaxPatrol EDR антивирусной лаборатории Positive Technologies. В 2025 году команда аналитиков антивирусной лаборатории PT ESC провела исследование актуальных семейств ransomware (aka шифровальщиков), чтобы повысить эффективность их обнаружения нашим продуктом. Этот вид ВПО оказался одной из наиболее значимых и заметных разновидностей вредоносов, используемых в атаках в 2025 году. Мы проанализировали образцы, замеченные в период с конца 2024 года по конец 2025-го. Были разобраны как давно известные семейства шифровальщиков, такие как Black Basta, MedusaLocker и LockBit, и относительно недавно появившиеся Lynx, HellCat и BERT. В этой статье хочу поделиться результатами этого исследования. Для начала расскажу про типы шифровальщиков, на кого они нацелены, как работают, подсвечу технические детали, а также ретроспективно прослежу некоторые тенденции в эволюции ransomware.

https://habr.com/ru/companies/pt/articles/1039170/

#ransomware #шифровальщики #вредоносное_по #lockbit #blackbasta #ransom #вымогательство #выкуп #кибератаки

Ransomware: математический аппарат на службе зла

Привет, Хабр! Я Илья Борисов, старший специалист отдела экспертизы MaxPatrol EDR антивирусной лаборатории Positive Technologies. В 2025 году команда аналитиков антивирусной лаборатории PT ESC провела исследование актуальных семейств ransomware (aka шифровальщиков), чтобы повысить эффективность их обнаружения нашим продуктом. Этот вид ВПО оказался одной из наиболее значимых и заметных разновидностей вредоносов, используемых в атаках в 2025 году. Мы проанализировали образцы, замеченные в период с конца 2024 года по конец 2025-го. Были разобраны как давно известные семейства шифровальщиков, такие как Black Basta, MedusaLocker и LockBit, и относительно недавно появившиеся Lynx, HellCat и BERT. В этой статье хочу поделиться результатами этого исследования. Для начала расскажу про типы шифровальщиков, на кого они нацелены, как работают, подсвечу технические детали, а также ретроспективно прослежу некоторые тенденции в эволюции ransomware.

https://habr.com/ru/companies/pt/articles/1039170/

#ransomware #шифровальщики #вредоносное_по #lockbit #blackbasta #ransom #вымогательство #выкуп #кибератаки

Operation Endgame 2: 15 Millionen E-Mail-Adressen und 43 Millionen Passwörter | Security https://www.heise.de/news/Operation-Endgame-2-15-Millionen-E-Mail-Adressen-und-43-Millionen-Passwoerter-10396199.html #HaveIBeenPwned #Malware #Ransomware #Hacking #CyberCrime #Bumblebee #Latrodectus #Qakbot #DanaBot #HijackLoader #Warmcookie #Trickbot #Prolock #Doppelpaymer #REvil #Conti #BlackBasta #Cactus #OperationEndgame2

Operation Endgame 2.0: 20 Haftbefehle, Hunderte Server außer Gefecht gesetzt | Security https://www.heise.de/news/Operation-Endgame-2-0-20-Haftbefehle-Hunderte-Server-ausser-Gefecht-gesetzt-10394215.html #OperationEndgame #OperationEndgame2 #Malware #Ranswomware #Hacking #CyberCrime #Bumblebee #Latrodectus #Qakbot #DanaBot #HijackLoader #Warmcookie #Trickbot #Prolock #Doppelpaymer #REvil #Conti #BlackBasta #Cactus

International Operation Targets Qakbot Hacker, $24M in Crypto Seized https://thecyberexpress.com/doj-indicts-alleged-qakbot-malware/ #RustamRafailevichGallyamov #USJusticeDepartment #ransomwareattacks #CryptoCrackdown #maliciousemails #RansomwareNews #cryptocurrency #FirewallDaily #Qakbotmalware #BlackBasta #CyberNews #Gallyamov #Qakbot #REvil #FBI

International Operation Targets Qakbot Hacker, $24M in Crypto Seized https://thecyberexpress.com/doj-indicts-alleged-qakbot-malware/ #RustamRafailevichGallyamov #USJusticeDepartment #ransomwareattacks #CryptoCrackdown #maliciousemails #RansomwareNews #cryptocurrency #FirewallDaily #Qakbotmalware #BlackBasta #CyberNews #Gallyamov #Qakbot #REvil #FBI

#TrendMicro discusses how the #BlackBasta and #Cactus #ransomware groups utilized the #BackConnect #malware to maintain persistent control and exfiltrate sensitive data from compromised machines. Learn more -> https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html

#TrendMicro discusses how the #BlackBasta and #Cactus #ransomware groups utilized the #BackConnect #malware to maintain persistent control and exfiltrate sensitive data from compromised machines. Learn more -> https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html

Happy Monday everyone!

Today's #readoftheday is brought to you by Trend Micro and they share their findings related to #BlackBasta and #CactusRansomware adding a piece of malware known as #BackConnect to their toolbox.

The report states "The BackConnect malware is a tool that cybercriminals use to establish and maintain persistent control over compromised systems. Once infiltrated, it grants attackers a wide range of remote control capabilities, allowing them to execute commands on the infected machine. This enables them to steal sensitive data, such as login credentials, financial information, and personal files."

Behaviors (MITRE ATT&CK):
Initial Access - TA0001:
Phishing: Spearphishing Voice - T1566.004 - The attackers conducted an email bombing campaign then contacted the victim posing as "IT Support" or "HelpDesk".

Command and Control - TA0011:
Remote Access Software - T1219 -
The attackers used QuickAssist to access the victim's environment once they were successfully social engineered.

Lateral Movement - TA0008:
Remote Services: SMB/ Windows Admin Shares - T1021.002 -
Remote Services: Windows Remote Management - T1021.006
The attackers leveraged both SMB, shared folders, and WinRM for lateral movement.

Go check out the rest of the technical details! Enjoy and Happy Hunting!

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html?&web_view=true

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Happy Monday everyone!

Today's #readoftheday is brought to you by Trend Micro and they share their findings related to #BlackBasta and #CactusRansomware adding a piece of malware known as #BackConnect to their toolbox.

The report states "The BackConnect malware is a tool that cybercriminals use to establish and maintain persistent control over compromised systems. Once infiltrated, it grants attackers a wide range of remote control capabilities, allowing them to execute commands on the infected machine. This enables them to steal sensitive data, such as login credentials, financial information, and personal files."

Behaviors (MITRE ATT&CK):
Initial Access - TA0001:
Phishing: Spearphishing Voice - T1566.004 - The attackers conducted an email bombing campaign then contacted the victim posing as "IT Support" or "HelpDesk".

Command and Control - TA0011:
Remote Access Software - T1219 -
The attackers used QuickAssist to access the victim's environment once they were successfully social engineered.

Lateral Movement - TA0008:
Remote Services: SMB/ Windows Admin Shares - T1021.002 -
Remote Services: Windows Remote Management - T1021.006
The attackers leveraged both SMB, shared folders, and WinRM for lateral movement.

Go check out the rest of the technical details! Enjoy and Happy Hunting!

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html?&web_view=true

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Happy Monday everyone!

Today's #readoftheday is brought to you by Trend Micro and they share their findings related to #BlackBasta and #CactusRansomware adding a piece of malware known as #BackConnect to their toolbox.

The report states "The BackConnect malware is a tool that cybercriminals use to establish and maintain persistent control over compromised systems. Once infiltrated, it grants attackers a wide range of remote control capabilities, allowing them to execute commands on the infected machine. This enables them to steal sensitive data, such as login credentials, financial information, and personal files."

Behaviors (MITRE ATT&CK):
Initial Access - TA0001:
Phishing: Spearphishing Voice - T1566.004 - The attackers conducted an email bombing campaign then contacted the victim posing as "IT Support" or "HelpDesk".

Command and Control - TA0011:
Remote Access Software - T1219 -
The attackers used QuickAssist to access the victim's environment once they were successfully social engineered.

Lateral Movement - TA0008:
Remote Services: SMB/ Windows Admin Shares - T1021.002 -
Remote Services: Windows Remote Management - T1021.006
The attackers leveraged both SMB, shared folders, and WinRM for lateral movement.

Go check out the rest of the technical details! Enjoy and Happy Hunting!

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html?&web_view=true

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Happy Monday everyone!

Today's #readoftheday is brought to you by Trend Micro and they share their findings related to #BlackBasta and #CactusRansomware adding a piece of malware known as #BackConnect to their toolbox.

The report states "The BackConnect malware is a tool that cybercriminals use to establish and maintain persistent control over compromised systems. Once infiltrated, it grants attackers a wide range of remote control capabilities, allowing them to execute commands on the infected machine. This enables them to steal sensitive data, such as login credentials, financial information, and personal files."

Behaviors (MITRE ATT&CK):
Initial Access - TA0001:
Phishing: Spearphishing Voice - T1566.004 - The attackers conducted an email bombing campaign then contacted the victim posing as "IT Support" or "HelpDesk".

Command and Control - TA0011:
Remote Access Software - T1219 -
The attackers used QuickAssist to access the victim's environment once they were successfully social engineered.

Lateral Movement - TA0008:
Remote Services: SMB/ Windows Admin Shares - T1021.002 -
Remote Services: Windows Remote Management - T1021.006
The attackers leveraged both SMB, shared folders, and WinRM for lateral movement.

Go check out the rest of the technical details! Enjoy and Happy Hunting!

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html?&web_view=true

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” – Source: news.sophos.com https://ciso2ciso.com/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing-source-news-sophos-com/ #rssfeedpostgeneratorecho #remotemachinemanagement #legitimateserviceabuse #MicrosoftOffice365 #SecurityOperations #CyberSecurityNews #ThreatResearch #nakedsecurity #pythonmalware #nakedsecurity #Javamalware #QuickAssist #blackbasta #BlackBasta

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” – Source: news.sophos.com https://ciso2ciso.com/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing-source-news-sophos-com/ #rssfeedpostgeneratorecho #remotemachinemanagement #legitimateserviceabuse #MicrosoftOffice365 #SecurityOperations #CyberSecurityNews #ThreatResearch #nakedsecurity #pythonmalware #nakedsecurity #Javamalware #QuickAssist #blackbasta #BlackBasta

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” – Source: news.sophos.com https://ciso2ciso.com/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing-source-news-sophos-com/ #rssfeedpostgeneratorecho #remotemachinemanagement #legitimateserviceabuse #MicrosoftOffice365 #SecurityOperations #CyberSecurityNews #ThreatResearch #nakedsecurity #pythonmalware #nakedsecurity #Javamalware #QuickAssist #blackbasta #BlackBasta

Black Basta Ransomware Uses MS Teams, Email Bombing to Spread Malware – Source:hackread.com https://ciso2ciso.com/black-basta-ransomware-uses-ms-teams-email-bombing-to-spread-malware-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #MicrosoftTeams #cybersecurity #Vulnerability #CyberAttacks #BlackBasta #Ransomware #DarkGate #Hackread #security #malware #Zbot

Black Basta Ransomware Uses MS Teams, Email Bombing to Spread Malware – Source:hackread.com https://ciso2ciso.com/black-basta-ransomware-uses-ms-teams-email-bombing-to-spread-malware-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #MicrosoftTeams #cybersecurity #Vulnerability #CyberAttacks #BlackBasta #Ransomware #DarkGate #Hackread #security #malware #Zbot

Black Basta Ransomware Uses MS Teams, Email Bombing to Spread Malware https://hackread.com/black-basta-gang-ms-teams-email-bombing-malware/ #MicrosoftTeams #Cybersecurity #Vulnerability #CyberAttacks #BlackBasta #Ransomware #Security #DarkGate #Malware #Zbot

Black Basta Ransomware Uses MS Teams, Email Bombing to Spread Malware https://hackread.com/black-basta-gang-ms-teams-email-bombing-malware/ #MicrosoftTeams #Cybersecurity #Vulnerability #CyberAttacks #BlackBasta #Ransomware #Security #DarkGate #Malware #Zbot

First #Cl0p; now #BlackBasta. #ENZ. It's not clear whether both extortions are based on the data obtained from the #MOVEit breach.

First #Cl0p; now #BlackBasta. #ENZ. It's not clear whether both extortions are based on the data obtained from the #MOVEit breach.

BlackBasta revendique des attaques informatiques à l'encontre de:

• 🇺🇸 Michael & Son Services (michaelandson.com)

• 🇺🇸 Potandon Produce LLC (potandon.com)

• 🇺🇸 Sound Publishing, Inc (soundpublishing.com)

• 🇺🇸 Karges-Faulconbridge, Inc (kfi-eng.com)

• 🇺🇸 Ennis, Inc (ennis.com)

• 🇺🇸 Woodhaven Lumber & Millwork (woodhavenlumber.com)

#usa #industries #potatoes #blackbasta #ransomware #production #hvac #design #market #onions #packing #growing #business #repair #sales #facilities #electrical #plumbing #news #heating #press #kitchen #cooling #equipment #infrastructure #careers #doors #moulding #flooring #air #restoration #water #boilers #tubes #remediation #investors #food #distributor #hospital #medical #maintenance #engineering #campus #blueprint #mechanical #electrical #shops #retails #commercial #construction #wastewater #clients #treatments #manufacturers #printing #partnership #media #advertising #journalism #threats #resources #customers #smart #tax #disinfection #building #schools #systems #ethanol #awards #chemical #safety #management #brands #databreach #fuel #barcoding #imaging #software #employees #plants #solutions #informatique

I have been seeing A LOT of verified compromises circulating hacker forums because of #BlackCat, #LockBit, #HiveRansomware, #Mallox, #BlackBasta #RoyalRansomware, #BianLian, #CubaRansomware, #BloodyRansomwareGang, #RansomEXX - I'm talking multiple terabytes of data, hundreds of millions of account details, across pretty much every single sector. Most common method of infection? #BusinessEmailCompromise! Be super mindful of the links you click on, the attachments you download, and the sites you visit

I have been seeing A LOT of verified compromises circulating hacker forums because of #BlackCat, #LockBit, #HiveRansomware, #Mallox, #BlackBasta #RoyalRansomware, #BianLian, #CubaRansomware, #BloodyRansomwareGang, #RansomEXX - I'm talking multiple terabytes of data, hundreds of millions of account details, across pretty much every single sector. Most common method of infection? #BusinessEmailCompromise! Be super mindful of the links you click on, the attachments you download, and the sites you visit

Les opérateurs Black Basta revendiquent une attaque informatique à l'encontre de :

• 🇺🇸 SeaCast (seacast.com)

• 🇺🇸 Cleveland Brothers Equipment Co., Inc (clevelandbrothers.com)

• 🇺🇸 AiRCo Mechanical (aircomechanical.com)

• 🇺🇸 Pella Mid-Atlantic, Inc (pellamidatlantic.com)

#usa #industrial #turbines #ransomware #companies #blackbasta #industries #foundries #technologies #medical #manufacturers #innovative #partnerships #contractors #clients #customers #marine #aero #lasers #automotive #gas #aerospace #military #machinery #pumps #defense #metallurgical #ultrasonic #treatments #components #maintenance #equipment #air #materials #repairs #support #welding #cooling #mechanical #heat #safety #residential #smart #services #systems #market #corporate #cnc #engineers #staff #commercial #electrical #solutions #plumbing #informatique

🇺🇸 Les opérateurs Black Basta revendiquent une attaque informatique à l'encontre de :

• 🇺🇸 Maney | Gordon | Zeller, P.A. (maneygordon.com)

• 🇨🇦 A.R. Thomson Group (arthomson.com)

• 🏴󠁧󠁢󠁳󠁣󠁴󠁿 Dingbro, Ltd (dingbro.com)

• 🇬🇧 ATCORE (atcoretec.com)

#usa #uk #scotland #canada #hvac #blackbasta #purification #ransomware #companies #industrial #batteries #products #pumps #packing #joints #steam #systems#services #electrical #customers #market #heat #business #paint #filtration #gas #automation #staff #fuel #instrumentation #fluids #containment #employees #refining #manufacturers #databreach #automotive #solutions #warehouse #engineers #technologies #facilities #power #solutions #threats #hydraulic #trucks #gaskets #innovative #future #petrochemical #cnc #oil #design #valves #sealing #informatique

🇺🇸 Les opérateurs BlackBasta revendiquent une attaque informatique à l'encontre de Panolam Surface Systems (panolam.com) #usa #innovative #ballistic #textiles #ransomware #protection #blackbasta #microbial #doors #pressure #wall #premium #future #resistant #design #panels #technologies #structural #systems #surfaces #commercial #brands #solutions #support #armortex #certification #bulletproof #laminate #business #products #customers #databreach #creative #electrostatic #plastic #furniture #building #interior #healthcare #corporate #facilities #schools #thermal #clients #panolam #residential #brochures #pionite #fiberglass #industries #nevamar #medical #floors #laboratories #informatique

• 🇺🇸 Les opérateurs BlackBasta revendiquent une attaque informatique contre Dillon Precision Products, Inc (dillonprecision.com) #usa #blackbasta #ammunition #tactical #ransomware #firearms #equipment #rifles #databreach #cyber #pistols #commercial #accessories #market #online #retails #business #shooting #threats #bullets #services #ammo #shop #products #components #catalog #machines #support #employees #guns #safety #informatique