Sunday, May 19, 2024

Beware Of New Social Engineering Attack That Delivers Black Basta Ransomware

Hackers exploit social engineering, which avoids technical security systems, by manipulating the psychology and behavior of a human being.

Social engineering techniques, such as baiting emails or pretexting phone calls, manipulate victims into providing confidential information or performing actions that impede security details. 

Attackers find it cheap and easy, as they need less specialist knowledge to make expensive use of trust, curiosity, or fear to trick their target.

Cybersecurity analysts at Rapid7 recently identified that threat actors have been actively exploiting a new social engineering attack that delivers Black Basta ransomware.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Technical Analysis

Rapid7 has uncovered multiple social engineering campaigns targeting several MDR clients.

Here, the spam emails flood the victims’ inboxes to make them accept remote access via tools such as AnyDesk or Quick Assist when someone pretending to be IT support calls them.

Once connected, the attacker downloads payloads to harvest credentials and maintain persistence, which could ultimately result in ransomware viruses, as in previous Black Basta operations.

This is a new take on things as it emerged towards the end of April 2024.

The attack begins by attacking affected users with a surge of seemingly harmless newsletter signup confirmation spam emails that bypass email protections.

Spam email (SOurce – Rapid7)

Next, the attacker makes phone calls to people who are directly affected, and they pretend to be IT support in order to resolve this email issue. 

Using social engineering, the hijacker persuades users to permit remote access through AnyDesk or Windows Quick Assist.

If one user does not succeed, the attacker immediately proceeds to the next targeted through spam campaigns.

Upon access acquisition, the infiltrator executes batch scripts that look like updates to make them appear genuine. The initial script tests C2 connectivity and downloads an OpenSSH for:-

  • Windows zip file (renamed RuntimeBroker.exe)
  • RSA keys
  • Dependencies
  • SSH config files

Registry run keys pointing to extra batch files ensure persistence. These scripts loop over SSH attempts at reverse shell connections to C2 using downloaded keys. 

Some of these scripts have hard C2 coding, while others can be overridden through command-line functions. Other versions also achieve persisting via NetSupport or ScreenConnect functionalities.

In all the instances, the attacker utilized a batch script that seemed like an “update” to harvest the victims’ credentials through PowerShell, with most of them being exfiltrated immediately by means of SCP.

Aiming to move laterally, after being compromised initially, there were attempts to deploy Cobalt Strike beacons that consisted of DLL side-loading.

Although no data theft or ransomware was deployed, the indicators match previous Black Basta operations based on intelligence.


Here below, we have mentioned all the mitigations provided:-

  • Make sure to block all the unapproved RMM tools.
  • Block all the domains that are associated with unapproved RMM tools. 
  • Users should also be trained in social engineering.
  • Ensure robust application allow-listing is enabled.

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free


Latest articles

Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make...

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles