This ransomware variant has now been used against 500 targets — here's what you need to know

Security agencies have issued a fresh alert about a ransomware variant that has been used to extort over $100 million from victims, warning that over 500 organizations have now been attacked using the strain.

The FBI and CISA, along with the US Department of Health and Human Services (HHS), have jointly released an alert about the Black Basta ransomware. They said gangs using this particular form of ransomware have now encrypted and stolen data from at least 12 out of 16 critical infrastructure sectors, including healthcare.

While it’s not entirely clear what caused these bodies to issue an alert right now, last week healthcare network Ascension was hit with a ransomware attack which affected its electronic health records systems as well as systems used to order tests, procedures, and medications.

CNN reported that Black Basta was the variant of ransomware used while Healthcare IT security group Health-ISAC said the group has recently accelerated attacks against the healthcare sector.

“In the past month, at least two healthcare organizations, in Europe and in the United States, have fallen victim to Black Basta ransomware and have suffered severe operational disruptions. Taking these latest developments into consideration, Health-ISAC has assessed that Black Basta represents a significant threat to the healthcare sector,” it said.

What is Black Basta ransomware?

Black Basta is a form of ransomware as a service (RaaS), which means the capability to launch attacks is effectively rented out to criminals that want to use it. It was first spotted in April 2022, and since then groups using it have attacked over 500 organizations in North America, Europe, and Australia. There are Windows and Linux variants of Black Basta ransomware.

According to one analysis published in November last year, the group and its affiliates had extorted over $100 million across more than 90 victims. The largest received ransom payment was $9 million, and at least 18 of the ransoms exceeded $1 million. The figures are likely to be significantly higher now, experts suggest.

The group may be a rebrand of the Russian-speaking RaaS threat group Conti, and is believed to specifically target healthcare because this is a sector with a very large amount of sensitive personal data.

“Healthcare organizations are attractive targets for cybercrime actors due to their size, technological dependence, access to personal health information, and unique impacts from patient care disruptions,” the CISA and FBI alert warned.

The gangs harnessing Black Basta ransomware use techniques such as phishing and exploit known vulnerabilities that haven’t been patched to gain access to networks.

According to security company Kroll, Black Basta attackers can gain initial access via a link to a malicious document delivered by email in a password-protected zip file. Once extracted, the document installs the Qakbot banking trojan to create backdoor access and then establishes an encrypted connection to a C2 server.

Often, Black Basta will maintain its hold on a network by using legitimate remote access software tools.

Spearphishing isn’t the only way that attacks start. The FBI and CISA noted that, starting in February 2024, Black Basta affiliates began exploiting ConnectWise vulnerability CVE-2024-1709 .

Once threat actors gain access to a network, they start to move around and attempt to steal more credentials and escalate their network privileges to gain access to more systems. They attempt to disable antivirus products including endpoint detection and response tools.

After this is achieved, they fully encrypt the files they have access to with a ChaCha20 algorithm with an RSA-4096 public key. A .basta or otherwise random file extension is added to file names and a ransom note titled readme.txt is left on the compromised system.

To make any attempts at system recovery harder, the attackers will attempt to delete volume shadow copies, too, the FBI and CISA said.

Similarly, they frequently use what’s called a double-extortion model, which means they will both encrypt systems and exfiltrate data.

Ransom notes do not generally include an initial ransom demand or payment instructions. Instead, the notes provide victims with a code and tells them to contact the ransomware group via a .onion URL.

The ransom notes give victims between 10 and 12 days to negotiate to pay the ransom before the ransomware group publishes their data on the Black Basta site, Basta News.

How to protect yourself from ransomware

The FBI, CISA and HHS said healthcare companies and other critical infrastructure organizations should employ a number of methods to reduce the likelihood of compromise from Black Basta and other ransomware attacks. 

These include:

• Installing updates for operating systems, software, and firmware as soon as they are released, with priority given to known exploited vulnerabilities.
• Building phishing-resistant multi-factor authentication into as many services as possible
• Training users to recognize and report phishing attempts 
• Ensuring that remote access software is secured and that there are backups of critical systems and device configurations to enable devices to be repaired and restored.

The agencies also made some recommendations specific to healthcare and critical infrastructure organizations:

• Cyber security pros should identify all interdependencies and what software is running to ensure critical data and systems are protected appropriately.
• Organizations should install anti-malware software and staff should beware embedded or spoofed hyperlinks.
• For vulnerability remediation, prioritize assets that are most critical for ongoing operations or which, if affected, could impact business continuity or sensitive personal information.

There’s one thing that the FBI, CISA, and HHS said they don’t encourage, which is paying a ransom, as payment does not guarantee victim files will be recovered, they said.

“Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities,” they warned.