{"id":2612,"date":"2025-03-15T10:04:33","date_gmt":"2025-03-15T10:04:33","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/03\/15\/black-basta-ransomware-attack-edge-network-devices-with-automated-brute-force-attacks\/"},"modified":"2025-03-15T10:04:33","modified_gmt":"2025-03-15T10:04:33","slug":"black-basta-ransomware-attack-edge-network-devices-with-automated-brute-force-attacks","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/03\/15\/black-basta-ransomware-attack-edge-network-devices-with-automated-brute-force-attacks\/","title":{"rendered":"Black Basta Ransomware Attack Edge Network Devices With Automated Brute Force Attacks"},"content":{"rendered":"

Black Basta Ransomware Attack Edge Network Devices With Automated Brute Force Attacks
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A Russian-speaking actor using the Telegram handle @ExploitWhispers leaked internal chat logs of Black Basta Ransomware-as-a-Service (RaaS) members on February 11, 2025.<\/p>\n

These communications, spanning from September 2023 to September 2024, have provided security researchers with unprecedented insight into the group\u2019s operational tactics and infrastructure used to target organizations across multiple sectors.<\/p>\n

Black Basta, which emerged in April 2022, has established itself as a sophisticated financially motivated cybercrime operation using double extortion tactics.<\/p>\n

The group has demonstrated a strategic focus on high-value targets where downtime creates significant financial and operational impact, with Business Services (33 incidents), Industrial Machinery (14), and Manufacturing (6) being their most frequently targeted sectors.<\/p>\n

Analysts at EclecticIQ identified<\/a> a previously unknown brute forcing framework that Black Basta RaaS members have used since 2023.<\/p>\n

This offensive framework, named \u201cBRUTED\u201d based on its log naming conventions, performs automated internet scanning and credential stuffing against edge network devices, including widely used firewalls and VPN solutions<\/a> in corporate networks.<\/p>\n

According to the leaked communications, Black Basta<\/a> operated multiple servers dedicated to brute-force attacks, including 45.140.17.40, 45.140.17.24, and 45.140.17.23, all registered under Proton66 (AS 198953) and located in Russia.<\/p>\n

These strategic choices were likely intended to evade Western law enforcement scrutiny while conducting their malicious activities.<\/p>\n

The analysis of the BRUTED framework revealed sophisticated capabilities targeting various remote-access and VPN solutions including SonicWall NetExtender, Palo Alto GlobalProtect, Cisco AnyConnect, Fortinet SSL VPN, Citrix NetScaler, Microsoft RDWeb, and WatchGuard SSL VPN.<\/p>\n

\n
\"\"
Source code of the BRUTED (Source \u2013 EclecticIQ)<\/figcaption><\/figure>\n<\/div>\n

The source code of BRUTED revealing its version and main C2 servers for communication.<\/p>\n

Technical Details of the BRUTED Framework<\/strong><\/h2>\n

The framework utilizes multiple advanced techniques to maximize its effectiveness.<\/p>\n

It employs proxy<\/a> rotation using a large list of SOCKS5 proxies from the domain fuck-you-usa.com to hide the attacker\u2019s server IP while performing a high volume of brute forcing requests.<\/p>\n

\n
\"\"
List of proxy servers inside the BRUTED source code (Source \u2013 EclecticIQ)<\/figcaption><\/figure>\n<\/div>\n

The framework also automates subdomain enumeration by prepending known prefixes (vpn, remote, mail, etc.) to base domains to discover potential targets.<\/p>\n

\n
\"\"
Password pair generation by using victim SSL cert (Source \u2013 EclecticIQ)<\/figcaption><\/figure>\n<\/div>\n

One particularly clever technique employed by BRUTED is extracting common names (CN) and Subject Alternative Names (SAN) from a target\u2019s SSL certificate to generate additional password guesses.<\/p>\n

A successful brute forcing attack might yield results like \u201cFound valid credentials\u201d for \u201c0ffice2023!\u201d on a SonicWALL device.<\/p>\n

After gaining initial access through compromised edge devices, Black Basta actors follow a structured attack chain deploying post-exploitation frameworks like Cobalt Strike<\/a> or Brute Ratel to establish command-and-control channels, extract credentials, and ultimately deploy ransomware payloads that encrypt network shares, virtualized environments, and cloud storage.<\/p>\n

Are you from SOC\/DFIR Teams? \u2013 Analyse Malware Incidents & get live Access with ANY.RUN ->\u00a0Start Now for Free<\/a>.<\/strong><\/code><\/strong><\/strong><\/p>\n

The post Black Basta Ransomware Attack Edge Network Devices With Automated Brute Force Attacks<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Black Basta Ransomware Attack Edge Network Devices With Automated Brute Force Attacks A Russian-speaking actor using the Telegram handle @ExploitWhispers leaked internal chat logs of Black Basta Ransomware-as-a-Service (RaaS) members on February 11, 2025. These communications, spanning from September 2023 to September 2024, have provided security researchers with unprecedented insight into the group\u2019s operational tactics […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[701,63,649],"tags":[130],"class_list":["post-2612","post","type-post","status-publish","format-standard","hentry","category-cyber-attack","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2612"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=2612"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2612\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=2612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=2612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=2612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}