Black Basta Ransomware Group’s Leaked Chats Reveal Cybercrime Tactics

The Black Basta ransomware group has been exposed through leaked internal chat communications, providing a rare glimpse into their operational tactics. The Veriti Research team analyzed these communications, revealing that Black Basta focuses on exploiting vulnerabilities in VMware ESXi, Microsoft Exchange, Citrix VPNs, Fortinet firewalls, and Active Directory. They actively discuss methods to bypass endpoint detection and response (EDR) solutions and security information and event management (SIEM) systems, demonstrating a sophisticated understanding of security measures.

Among the specific vulnerabilities discussed are CVE-2024-1086, a zero-day Linux privilege escalation vulnerability, and CVE-2024-21762, a remote code execution vulnerability in Fortinet firewalls. The group also shares credentials for compromised Citrix VPNs, indicating successful access to networks in Mexico, Spain, and the US. Their discussions reveal a clear intent to exploit misconfigured systems and weak security practices.

Understanding Black Basta’s Exploits

Black Basta’s conversations highlight their use of cloud services for malware hosting and command-and-control infrastructure, indicating a shift towards cloud-based attacks. They express frustration with security defenses that disrupt their operations, particularly EDR solutions from vendors like CrowdStrike, Bitdefender, and Kaspersky. The group’s awareness of threat intelligence feeds, such as those from Spamhaus and Rapid7, shows their adaptability in evading detection.

In summary, the leaked chats illustrate that Black Basta is not just a group of opportunistic hackers but a highly organized and well-funded operation that continuously refines its methods. Their discussions about exploiting firewalls, manipulating web application firewalls (WAFs), and bypassing security measures underscore the importance of proactive security measures for organizations.

• VMware ESXi – Black Basta exploits vulnerabilities in misconfigured ESXi servers to gain unauthorized access.
• Microsoft Exchange – They confirm historical exploitation of Exchange Server vulnerabilities, including ProxyShell.
• Fortinet – The group discusses using Fortinet vulnerabilities to infiltrate corporate networks.
• Citrix VPN – They share credentials indicating successful access to compromised Citrix VPNs.
• EDR Solutions – Black Basta discusses techniques to bypass EDR solutions from vendors like CrowdStrike and Kaspersky.