Thread by @dabeave666

1/8 A few months back, we stopped a #ransomware attack by the group #BlackBasta. We spent a lot of time studying their backend servers, malware and more.

If you're interested in #ransomware, then you'll want to read this story...

2/8 It ends up that the #BlackBasta gang uses victims networks to log back into their own network! The leads to some interesting monitor opportunities.

This allowed us to monitor _them_.

On the victims servers, we deploy "clip board" monitoring.

3/8 This means we could see everything the attacker "cuts and pastes" within the victims environment. This includes passwords, commands, Russian comments, etc.

We are publishing it all.

4/8 Our team examined logs (Windows events/syslog) from #Sagan & packet dumps from #Suricata. This allowed us to understand lateral movement & tools #BlackBasta used.

We tore apart #Baclkbasta malware to better understand their methods. This is a good place to start!

5/8 The white paper "Technical Analysis: Black Basta Malware Overview" goes into details about the attack and the malware used. This includes TTPs and IOCs that were discovered:

quadrantsec.com/resource/techn…

It's a great read and I highly recommend it!

6/8 The white paper "Expert Insights: Black Basta Backend Operations" goes into what we discovered about #Blackbasta "backend" operations.

That is, how they run their own servers and network.

quadrantsec.com/blog/expert-in…

7/8 These both go into previously unknown IoC and TTPs related to the #ransomware gang. If you only take away the IoC/TTPs, then its worth it.

TLDR? We did a podcast with @DomainTools called "Breaking Badness". You can listen to that at:

domaintools.com/resources/podc…

8/8 Lastly, I couldn't be more proud and honored to work with the @Quadrantsec team! This is hours upon hours of research and work that they absolutely killed.

If you have any questions, please feel free to ask them!