As if keeping up with all the current ransomware families wasn’t enough, the new kid on the ransomware block, Black Basta, is seeing significant gains in the number of documented victim organizations since it first appeared in April of this year. Using a combination of malicious Office documents, QakBot, CobaltStrike Beacon, and their own ransomware payload as part of their attacks, Black Basta is considered to be a formidable foe.
Thought to possibly be one of two new brandings of the Conti ransomware gang (with the other being BlackByte), Black Basta improves its performance over it’s supposed predecessor, using intermittent encryption to speed up the process, theoretically impacting more systems within a victim environment before being detected by security systems.
And while the current iteration of attacks seems to indicate a selective targeting of victim organizations, the availability of Black Basta to affiliates opens up the possibility for far more attacks with far less victim selectivity.
In this Real Training for Free webinar, 4-time Microsoft MVP, Nick Cavalancia, takes my seat as he first discusses:
- The history of Conti, BlackByte, and Black Basta
- Who’s at risk of attack: the specifics so far
- Why threat groups (including Black Basta) are turning to intermittent encryption
Next up, you’ll hear from 18-time Microsoft MVP, Jeremy Moskowitz, as he dives deeper into Black Basta, providing insight into exactly which actions the ransomware attack takes, including:
- Initial attack vector
- Reconnaissance
- Persistence
- Lateral Movement
- Privilege Escalation
Jeremy will also discuss practical advice on how to stop Black Basta (and other ransomware families) using both native and third-party toolsets as the means of mitigation.
This Real Training for Free session will be chock full of practical, real-world content!