Beware Of New Social Engineering Attack That Delivers Black Basta Ransomware

Hackers exploit social engineering, which avoids technical security systems, by manipulating the psychology and behavior of a human being.

Social engineering techniques, such as baiting emails or pretexting phone calls, manipulate victims into providing confidential information or performing actions that impede security details. 

Attackers find it cheap and easy, as they need less specialist knowledge to make expensive use of trust, curiosity, or fear to trick their target.

Cybersecurity analysts at Rapid7 recently identified that threat actors have been actively exploiting a new social engineering attack that delivers Black Basta ransomware.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Technical Analysis

Rapid7 has uncovered multiple social engineering campaigns targeting several MDR clients.

Here, the spam emails flood the victims’ inboxes to make them accept remote access via tools such as AnyDesk or Quick Assist when someone pretending to be IT support calls them.

Once connected, the attacker downloads payloads to harvest credentials and maintain persistence, which could ultimately result in ransomware viruses, as in previous Black Basta operations.

This is a new take on things as it emerged towards the end of April 2024.

The attack begins by attacking affected users with a surge of seemingly harmless newsletter signup confirmation spam emails that bypass email protections.

Spam email (SOurce – Rapid7)

Next, the attacker makes phone calls to people who are directly affected, and they pretend to be IT support in order to resolve this email issue. 

Using social engineering, the hijacker persuades users to permit remote access through AnyDesk or Windows Quick Assist.

If one user does not succeed, the attacker immediately proceeds to the next targeted through spam campaigns.

Upon access acquisition, the infiltrator executes batch scripts that look like updates to make them appear genuine. The initial script tests C2 connectivity and downloads an OpenSSH for:-

  • Windows zip file (renamed RuntimeBroker.exe)
  • RSA keys
  • Dependencies
  • SSH config files

Registry run keys pointing to extra batch files ensure persistence. These scripts loop over SSH attempts at reverse shell connections to C2 using downloaded keys. 

Some of these scripts have hard C2 coding, while others can be overridden through command-line functions. Other versions also achieve persisting via NetSupport or ScreenConnect functionalities.

In all the instances, the attacker utilized a batch script that seemed like an “update” to harvest the victims’ credentials through PowerShell, with most of them being exfiltrated immediately by means of SCP.

Aiming to move laterally, after being compromised initially, there were attempts to deploy Cobalt Strike beacons that consisted of DLL side-loading.

Although no data theft or ransomware was deployed, the indicators match previous Black Basta operations based on intelligence.

Mitigations

Here below, we have mentioned all the mitigations provided:-

  • Make sure to block all the unapproved RMM tools.
  • Block all the domains that are associated with unapproved RMM tools.
  • Users should also be trained in social engineering.
  • Ensure robust application allow-listing is enabled.

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…

2 days ago

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code execution…

2 days ago

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…

2 days ago

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…

2 days ago

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

2 days ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

3 days ago