Leaked ransomware chat logs offer unique insights into attack methodologies

What happened? 

On 24 February, cybersecurity firm VulnCheck published an analysis of chat logs from a ransomware group known as "Black Basta" showing insight into the technical vulnerabilities that the group favoured in their attacks. The chat logs had been made public by an anonymous leaker calling themselves "ExploitWhispers" earlier in the month. It wasn't clear if this was a disgruntled former member of the group, or a security researcher who had managed to gain access to the logs. 

The group are one of the most prolific active criminal ransomware gangs operating, with victims including large household companies and government departments, so details of their attack methods are a trove of useful intelligence for network defenders wanting to get inside the minds of their adversaries. 

So what? 

Perhaps unsurprisingly, the chats showed that the group largely favoured known vulnerabilities with "proof-of-concept" (POC) code that was freely available. POCs are the building blocks for attackers to easily exploit the vulnerabilities and are a quick and cost-effective way to facilitate the compromise of targets. 

The group also revealed that they favoured targeting several initial access devices, email and communications services and Microsoft technologies, likely due to their ubiquitous use by many organisations, a good "way in" to networks and the rich access they provide to useful data for extortion or theft. 

The group are keen consumers of new developments, quickly discussing and adopting newly found vulnerabilities into their attacks. They also had privileged knowledge of at least three vulnerabilities before they were officially published, demonstrating that they likely had relationships with bad actors involved in the early discovery of these. On some occasions, they also showed a tentative interest in purchasing exploits. As well as curiosity about newer vulnerabilities, the group were also interested in older yet effective ones, demonstrating their commitment to continual improvement of their attacks. 

As well as the vulnerabilities, there was evidence of the group's use of common and sometimes purely legitimate platforms and tools to aid their attacks including ChatGPT, ZoomInfo, GitHub, Shodan, Fofa, Metasploit, Core Impact, Cobalt Strike, and Nuclei among others.  

Network defenders are encouraged to review the list of discussed vulnerabilities in the table below against their own networks to ensure that they are not vulnerable to attacks. Furthermore, the focus on Microsoft, edge devices, email and communications serves to focus the minds of defenders on new, impactful vulnerabilities, particularly those that are being actively exploited, or for which there are POCs readily available. 

The vulnerabilities discussed by the group