Group Profile: BlackBasta
Perfil del grupo ransomware segun BushidoUK Ransomware Vulnerability Matrix. Incluye vulnerabilidades conocidas, herramientas y TTPs asociadas.
BlackBasta's Exploited Vulnerabilities
> [!NOTE]
> This is the list of vulnerabilities that have been observed during intrusions that lead to BlackBasta ransomware deployment or data exfiltration and leaks published to BlackBasta's Tor Site
ConnectWise
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|---|---|---|
| ScreenConnect | CVE-2024-1709 & CVE-2024-1709 | BlackBasta | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a" rel="noopener" target="_blank">cisa.gov</a> |
VMware
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|---|---|---|
| ESXi | CVE-2024-37085 ("ESX Admins") | BlackBasta | <a href="https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/" rel="noopener" target="_blank">microsoft.com</a> |
Windows
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|---|---|---|
| Windows Error Reporting Service | CVE-2024-26169 | BlackBasta | <a href="https://www.security.com/threat-intelligence/black-basta-ransomware-zero-day" rel="noopener" target="_blank">www.security.com</a> |
| MSDT | CVE-2022-30190 ("Follina") | BlackBasta | <a href="https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/" rel="noopener" target="_blank">sentinelone.com</a> / <a href="https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html" rel="noopener" target="_blank">trendmicro.com</a> |
| Active Directory | CVE-2021-42278 & CVE-2021-42287 ("NoPac") | BlackBasta | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a" rel="noopener" target="_blank">cisa.gov</a> |
| Print Spooler | CVE-2021-1675 & CVE-2021-34527 ("PrintNightmare") | BlackBasta | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a" rel="noopener" target="_blank">cisa.gov</a> |
| NetLogon | CVE-2020-1472 ("ZeroLogon") | BlackBasta | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a" rel="noopener" target="_blank">cisa.gov</a> |
---
#### Sources
| Date Published | Report |
|---|---|
| 29 July 2024 | https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ |
| 10 May 2024 | https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a |