Black Basta, a Ransomware-as-a-Service organization, has been using Windows Quick Assist (a remote access tool) to install ransomware onto victims’ computers.

Black Basta has been operational since before April of 2022 and is believed to be one of the factions of the cybercrime group Conti. They have been involved in attacks on many high-profile organizations including the recent breach of Ascension, a US healthcare giant. That breach forced Ascension to cancel procedure and divert emergency services.

On May 11^th, the FBI and the US Cybersecurity and Infrastructure Security Agency (CISA) stated Black Basta affiliates have been involved in the breaches of more than 500 organizations, attacking 12 of the 16 critical infrastructure sectors.

The attacks begin with a Black Basta hacker signing a victim up for email subscriptions, bombarding them with emails. The attackers then impersonate tech support to help get rid of the created ‘spam problem.’ Through vishing (voice phishing), the attacker convinces the victim to allow remote access to their computer through Quick Assist.

Once the attacker gains access, they download Remote Access Trojans (RATs), networking programs, malware, and other malicious files and tools. They will also install programs to harvest credentials on occasion. The tools are used to establish and maintain a presence, elevate privileges, and move laterally throughout the network allowing encryption of data, the deployment of the Black Basta ransomware tool, and holding company files for ransom.

Protecting yourself and your company from these attacks is simple. If your company does not already use Quick Assist, block it from your network and uninstall it from corporate devices. If your company uses Quick Assist, ensure that monitoring is in place to detect suspicious behavior and proper response procedures are in place.

Ransomware can be debilitating to a company. Training yourself and employees on phishing, vishing, and recognizing scams will keep your most valuable assets safe.

BACK TO BLOGS