Gone But Not Forgotten: Black Basta’s Enduring Legacy

EXTRACT IOC

The ransomware group Black Basta disbanded after internal chat leaks, but its tactics, especially mass email spam and Microsoft Teams phishing, continue to be used by former members and new groups. Emerging attack methods now include Python script execution with cURL for payload delivery, emphasizing the need for strong user education and vigilant defense strategies. #BlackBasta #MicrosoftTeamsPhishing #CactusRaaS

Keypoints

Black Basta collapsed in February 2025 following a leak of its private chats, exposing its internal operations and causing the shutdown of its data-leak site.
Despite the group’s dissolution, former members continue using Black Basta’s tactics, notably mass email spam and Microsoft Teams phishing, which remain prevalent in attacks.
Recent attacks have introduced Python script execution alongside Teams phishing, using cURL to download and run malicious payloads, indicating evolving techniques.
Black Basta operated with a structured organization, including roles such as intrusion specialists, managers, and developers, and collaborated with other malware groups like QakBot and DarkGate.
New ransomware groups such as Cactus and Blacklock are believed to include former Black Basta affiliates, continuing similar attack patterns and ransomware campaigns.
Phishing attacks heavily rely on onmicrosoft[.]com domains for impersonation, with rising attempts to use legitimate microsoft[.]com domains to increase phishing credibility.
Organizations should focus on employee education, implement strict policies against personal Google account use on company devices, monitor for unauthorized Python executions, and deploy responsive detection playbooks.

MITRE Techniques

[T1566] Phishing – Black Basta used mass email spam followed by Microsoft Teams phishing and calls to gain initial access (‘mass email spam followed by Teams phishing and vishing attempts’).
[T1078] Valid Accounts – Brute forcing accounts for remote services like RDP and VPN was utilized (‘Brute-forced accounts for external remote services’).
[T1105] Ingress Tool Transfer – Use of cURL for downloading malicious payloads via Python script execution after initial access (‘using cURL requests to fetch and deploy malicious payloads’).
[T1041] Exfiltration Over C2 Channel – Stolen data was exfiltrated using tools such as Rclone, WinSCP, and FileZilla (‘command-line tool for syncing and transferring stolen files to remote storage’).
[T1059] Command and Scripting Interpreter – Python scripts were employed to execute malicious payloads stealthily post-compromise (‘Python to execute cURL and download a malicious .md file’).
[T1569] System Services – Attackers used remote assistance tools like Quick Assist and AnyDesk to gain control over compromised hosts (‘manipulated a user into joining two remote sessions via Quick Assist and AnyDesk’).
[T1592] Gather Victim Identity Information – Information gathering included using business intelligence tools like ZoomInfo and data archives such as Intelligence X (‘Gathered victim revenue data using ZoomInfo business intelligence’).

Indicators of Compromise

[Email Addresses] Source of Teams phishing – administratorIT.onmicrosoft[.]com, supportbot[at]supportteamits.onmicrosoft[.]com
[Domains] Teams phishing campaigns – onmicrosoft[.]com domains including ACTgroup620.onmicrosoft[.]com
[IP Addresses] Command and control server – 161.35.60[.]146 used to host malicious Python-executed payload

Tags: VPN, ZERO-DAY, DEFENSE EVASION, SPAM, MONITOR, DARK WEB, PASSWORD, INITIAL ACCESS