Blackbasta Ransomware

The BlackBasta ransomware is a malicious software developed by a Russia-linked group known for exploiting and damaging computer systems, often without the user's knowledge. The group has been involved in numerous high-profile cyberattacks, including those on American Alarm and Communications, a leading provider of security and communication solutions, and Viking Coca-Cola, one of the largest Coca-Cola bottlers in the US. In these attacks, the group stole data and published it on their data leak website. Over the past 22 months, the BlackBasta ransomware gang has extracted over $107 million from its victims. BlackBasta's method of operation includes the use of botnet tools like PikaBot for encrypted communications with command and control (C&C) servers. By January 2024, the group had shifted to using PikaBot, along with another emerging threat group, Water Curupira, which also used PikaBot to drop BlackBasta ransomware. Moreover, the operators were observed posing as corporate help desks, contacting employees under the guise of helping them mitigate an ongoing spam attack. Investigations have revealed the existence of two other unreported ransomware groups, Ghost Clown and Space Kook, that rely on Cloudzy as a C2P. These groups have been seen deploying Cobalt Strike implants and various types of ransomware, including Conti and BlackBasta. Notably, BlackBasta has been linked to the use of QakBot, typically delivered via phishing emails, to target multiple industries. It was also reported that BlackBasta exposed personal information, such as U.S. passports and driver’s licenses, belonging to bank customers.