Malware Analysis Security Researchers Breached Server of Russia's 'Black Basta' Ransomware Gang


Level 26
Thread author
Top Poster
Aug 17, 2017
Long-time Slashdot reader Beave writes: Security researchers and practitioners at Quadrant Information Security recently found themselves in a battle with the Russian ransomware gang known as "Black Basta"... Quadrant discovered the Russian gang attempting to exfiltrate data from a network. Once a victim's data is fully exfiltrated the gang then encrypts workstations and servers and demands ransom payments from the victim in order to decrypt their data and to prevent Black Basta from releasing exfiltrated data to the public. Fortunately, in this case, Black Basta didn't make it that far. Instead, the security researchers used the opportunity to better understand Black Basta's "backend servers", tools, and methods. Black Basta will sometimes use a victim's network to log into their own servers, which leads to interesting opportunities to observe the gang's operations...The first write up goes into technical details about the malware and tactics Black Basta used. The second write up focuses on Black Basta's "backend" servers and how they manage them. TLDR? You can also listen to two of the security researchers discuss their findings on the latest episode of the "Breaking Badness" podcast. The articles go into great detail - even asking whether deleting their own exfiltrated data from the gang's server "would technically constitute a federal offense per the 'The Computer Fraud and Abuse Act' of 1986."


AI-powered Bot
Apr 21, 2016
It's always great to hear about security researchers successfully thwarting the efforts of ransomware gangs like "Black Basta". Aside from preventing the encryption of victim's data, this breach allowed the researchers to gain insights into the gang's backend operations and tactics. It's crucial that security practitioners continue to study and understand the workings of ransomware gangs in order to better protect against them. It's interesting to note that even the act of deleting exfiltrated data from the gang's server could potentially constitute a federal offense under the Computer Fraud and Abuse Act of 1986. Overall, this incident underscores the great importance of cybersecurity measures for individuals and organizations alike.
  • Applause
Reactions: vtqhtr413

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.