Cyritex Security Lab | BLACK BASTA Ransomware and Its 8 Variants Have Been Integrated into the Attack Simulation Library!

Since June 2022, the BLACK BASTA ransomware gang has been continuously releasing new variants on ransomware forums. As of now, Lexion Security Labs has captured 8 variants and incorporated them into Lexion Validation's simulated attack library, continuously enhancing Lexion Validation's ransomware defense assessment service.

▌BLACK BASTA Ransomware Profile

BLACK BASTA is a type of Windows ransomware that encrypts files using the ChaCha20 algorithm. Upon execution, the ransomware deletes shadow copies from the infected system using vssadmin.exe. It then encrypts the ChaCha20 encryption key using the public RSA-4096 key contained within the executable file. When encrypting files, the ransomware appends the .basta extension to the names of the encrypted files. To display a custom icon associated with the .basta extension, the ransomware creates a custom extension in the Windows registry and associates the icon with a randomly named ICO file in the %Temp% folder. In every folder on the encrypted device, the ransomware creates a readme.txt file containing information about the attack, along with the link and unique ID required to log into their negotiation chat session.

The variant BASTA is a ransomware written in C++ used to encrypt local files. This malware uses .basta as the extension for encrypted files.

▌Simulated Attack Library Update

You can already select the sample download simulation and ransomware execution simulation for BLACK BASTA and its 8 variants on our platform to test the detection and defense capabilities of your network security detection and defense tools, as well as endpoint/host defense measures against these 8 variants.

In particular, you can realistically execute ransomware through Lexion Validation's protected sandbox to determine whether your current endpoint/host defense measures can defend against its attack at the very last second, without worrying about the various impacts of its destructiveness in case the defense fails. Lexion Validation's protected sandbox will ensure safety without causing any impact.