“Black Basta” Ransomware

Original Issue Date:- June 09, 2022

Virus Type:- Ransomware

Severity:- Medium

It is reported that a new ransomware called “Black Basta”, is spreading across the globe. The variants of this ransomware are focused on Windows platform, however, new variants targeting ESXi virtual machines running on Linux servers that facilitates the attackers with encrypting multiple servers with one command are also developed. For attacking ESXi servers, ransomware looks for the /vmfs/volumes; the location where VMs are stored in compromised ESXi servers.

The ransomware steals the sensitive data of the system before starting system encryption. Threat actors maintain the ‘Black Basta Blog' or 'Basta News' site on Tor where the data leak information of victims is handled.

Infection Mechanism:

The ransomware requires administrative privileges for its encryption functionalities. Upon execution, the encryptor deletes the shadow volume files using vssadmin.exe so to make Windows recovery difficult. The malware also changes the desktop wallpaper and encrypted file icons as shown:

The ransomware also has capabilities to hijack existing genuine Windows FAX service and creating a malicious service named ‘FAX’. The figure below shows the hijacked/malicious FAX service:

Fig.3 Hijacked Fax Windows service used to launch encryptor executable (source: Bleeping Computer)

The ransomware forces the system to reboot in safe mode while hijacked FAX service launches and automatically starts encrypting the files on the system. All encrypted files are appended with .basta extension.

In each affected folder, a readme.txt file is created which contains the attack information, a link and unique ID required to login to attackers’ chat session for negotiation.

Fig. 4 Ransom Note dropped by Black Basta (source: Trend Micro)

Fig. 5 Black Basta ransom note for Linux (source: Bleeping Computer)

The Tor negotiation/payment site is titled 'Chat Black Basta' as shown below:

Fig. 6 Black Basta payment site (source: Trend Micro)

As observed, the ransomware employs ChaCha20 algorithm to encrypt files. The ChaCha20 encryption key is further encrypted with a public RSA-4096 key that is included in the executable. The ransomware also uses multithreading approach to utilize multiple processors for speeding up the encryption process.

IoC:

SHA 256:

5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e
17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90
a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1
1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250
2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88
f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff

For complete list of IOC (Hashes and detected file names), kindly refer:

https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html

Countermeasures:

Maintain offline backups of data, and regularly maintain backup and restoration. This practice will ensure the organization will not be severely interrupted, have irretrievable data.
Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted) and covers the entire organization’s data infrastructure
Implement all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to have strong, unique passwords.
Implement multi-factor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
Remove unnecessary access to administrative shares
Use a host-based firewall to only allow connections to administrative shares via server message block (SMB) from a limited set of administrator machines
Enable protected files in the Windows Operating System to prevent unauthorized changes to critical files
Disable remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration
Check regularly for the integrity of the information stored in the databases
Ensure integrity of the codes /scripts being used in database, authentication and sensitive system
Establish Domain-based Message Authentication, Reporting, and Conformance (DMARC), Domain Keys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches
Application white listing/Strict implementation of Software Restriction Policies (SRP)to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
Maintain updated Antivirus software on all systems
Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through browser
Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with dedicated pool for RDP access
Use strong authentication protocol, such as Network Level Authentication (NLA) in Windows.
Additional Security measures that may be considered are

Use RDP Gateways for better management
Change the listening port for Remote Desktop
Tunnel Remote Desktop connections through IPSec or SSH
Two-factor authentication may also be considered for highly critical systems

If not required consider disabling, PowerShell / windows script hosting.
Restrict users' abilities (permissions) to install and run unwanted software applications.
Enable personal firewalls on workstations.
Implement strict External Device (USB drive) usage policy.
Employ data-at-rest and data-in-transit encryption.
Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empanelled auditors. Repeat audits at regular intervals.
Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies

References: