#blackbasta — Public Fediverse posts

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” – Source: news.sophos.com https://ciso2ciso.com/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing-source-news-sophos-com/ #rssfeedpostgeneratorecho #remotemachinemanagement #legitimateserviceabuse #MicrosoftOffice365 #SecurityOperations #CyberSecurityNews #ThreatResearch #nakedsecurity #pythonmalware #nakedsecurity #Javamalware #QuickAssist #blackbasta #BlackBasta

Happy Wednesday everyone!

While researching the #BlackBasta ransomware, I came across a couple great articles (not that all of them aren't great, I just haven't read ALL of them).

The first is from RedSense, a threat intelligence org that takes a deep dive into "The Evolution of BlackBasta Malware Dissemination" where they look at BlackBasta activity from 2022 up to today. They provide historic examples of what led up to this point but also provide wonderful technical details on malware and behaviors. In 2024 they were seen exploiting Microsoft Teams vulnerabilities and how they tricked victims to download RMM tools like AnyDesk to gain access to their machine and network.

One behavior that may indicate that you are a victim of ANY ransomware, but one attributed to BlackBasta, is suspicious BCDEdit.exe activity. BCDEdit is a command-line tool for managing Boot Configuration Data, or BCD, and the ransomware modifies the configuration to prevent recovery.

This is a great article and I hope you get as much out of it as I did! Happy Hunting!

The Evolution of BlackBasta Malware Dissemination
https://redsense.com/publications/evolution-of-blackbasta-malware-dissemination/

Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #huntoftheday #gethunting Cyborg Security, Now Part of Intel 471

🔎 IcedID’s VNC Backdoors: Dark Cat, Anubis & Keyhole

A summary of #VNC #backdoor capabilities reconstructed from network traffic.

👀 Screenshots, videos and clipboard data at https://blog.nviso.eu/2023/03/20/icedids-vnc-backdoors-dark-cat-anubis-keyhole/

#Malware #PCAP #Reversing #DarkCat #Anubis #Keyhole #DarkVNC #IcedID #Karakurt #BlackBasta