A recent Black Basta campaign has been causing frustration among victims by bombarding them with spam emails and deploying fake customer service representatives to persuade them into downloading malware. This deceptive tactic marks a new direction for the notorious ransomware-as-a-service (RaaS) operation, which has been known for its targeted attacks on critical infrastructure.
The campaign, identified by researchers from Rapid7, involves sending a large volume of spam emails to victims across various industries, including manufacturing, construction, food and beverage, and transportation. These emails serve as a precursor to phone calls from fake IT staff members offering assistance to the recipients. If the victims agree to the proposed help, the attackers initiate their intrusion.
According to Robert Knapp, senior manager of incident response services at Rapid7, the attacks appear to be more opportunistic rather than specifically targeted, given the diverse range of organizations affected. Since its discovery in April 2022, Black Basta has successfully infiltrated over 500 organizations globally, with a focus on critical infrastructure sectors in the US, Europe, and Australia.
One notable aspect of this latest campaign is the use of legitimate-looking emails, which contribute to the sense of confusion and irritation experienced by the targets. The attackers then exploit this annoyance by posing as helpful IT personnel and guiding the victims to download remote support tools like AnyDesk or Windows’ Quick Assist utility.
If the target complies with the instructions, the attacker gains access to their computer and executes a series of batch scripts designed to establish a connection with the attacker’s command-and-control infrastructure. This enables the attacker to maintain control over the victim’s system by creating run key entries in the Windows registry and establishing a reverse shell for continuous access.
While the researchers did not observe any large-scale data exfiltration or extortion during this particular campaign, they caution that these actions may still be forthcoming. To mitigate the risk posed by such attacks, organizations are advised to review their use of remote monitoring and management (RMM) solutions and employ allowlisting tools like AppLocker or Microsoft Defender Application Control to restrict unauthorized RMM software.
In instances where blocking these activities proves challenging, vigilant monitoring and response protocols are recommended. By monitoring for unusual activities such as the installation and execution of AnyDesk, organizations can identify and respond to potential security breaches promptly.
As the threat landscape continues to evolve, it is crucial for organizations to remain proactive in implementing robust cybersecurity measures to defend against malicious actors like Black Basta. By staying informed and adopting best practices in cybersecurity, businesses can better safeguard their critical assets and infrastructure from ransomware attacks and other cybersecurity threats.