FortiGuard Outbreak Alert: Black Basta Ransomware

[nchow]

FortiGuard Outbreak Alert: Black Basta Ransomware

Description	Black Basta is a type of ransomware-as-a-service (RaaS) that was first discovered in April 2022. Since then, its affiliates have targeted numerous businesses and critical infrastructure in North America, Europe, and Australia. By May 2024, Black Basta had impacted over 500 organizations worldwide. Black Basta has been seen using techniques such as phishing and exploiting public-facing applications to gain initial access, specifically exploiting CVE-2024-1709, an authentication bypass that allows attackers to create admin accounts on vulnerable instances, while CVE-2020-1472(DCSync), CVE-2021-42278 and CVE-2021-42287 are privilege escalation techniques.
CVE ID	CVE-2024-1709 (https://nvd.nist.gov/vuln/detail/CVE-2024-1709) CVE-2020-1472 (https://nvd.nist.gov/vuln/detail/CVE-2020-1472) CVE-2021-42278 (https://nvd.nist.gov/vuln/detail/CVE-2020-42278) CVE-2021-42287 (https://nvd.nist.gov/vuln/detail/CVE-2020-42287) CVE-2021-34527 (https://nvd.nist.gov/vuln/detail/CVE-2021-34527)
NDR Cloud Detection Rule	FortiNDR Cloud v2024.6+ Detection Rule Name Category Primary MITRE ID FortiGuard Outbreak Alert: ScreenConnect Exploit to Vulnerable Server (CVE-2024-1709) Attack: Exploitation T1190 - Exploit Public-Facing Application Privilege Escalation via SamAccountName Spoofing - CVE-2021-42278 Attack: Privilege Escalation T1068 - Exploitation for Privilege Escalation PrintNightmare Windows Print Spooler RCE (CVE-2021-34527) Attack: Exploitation T1547 - Boot or Logon Autostart Execution
Playbook	N/A
Threat hunting	FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for “Black Basta Ransomware” related activities IOC source: https://www.fortiguard.com/outbreak-ioc?tag=Black%20Basta%20Ransomware All IOCs listed above have been added to Threat Intelligence Intel under "Fortinet Outbreak Alert" Collection
Suricata Coverage	Customers can create custom investigation/detections using the Suricata signatures below: 2030870 →  ET EXPLOIT Possible Zerologon NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472) 2030871 →  ET EXPLOIT Possible Zerologon NetrServerAuthenticate with 0x00 Client Credentials (CVE-2020-1472) 2030888 →  ET EXPLOIT [401TRG] Possible Zerologon (CVE-2020-1472) UUID flowbit set 2030889 →  ET EXPLOIT [401TRG] Possible Zerologon (CVE-2020-1472) M2
Other Fortinet Products	For more details regarding mitigating the vulnerability by utilizing Fortinet products, please refer to https://www.fortiguard.com/outbreak-alert/black-basta-ransomware