There has been a significant decrease in social engineering attacks linked to the Black Basta ransomware group since late December 2024.
This lapse also included the leaked Black Basta chat logs in February 2025, indicating internal conflict within the group. Despite this, Rapid7 has observed sustained social engineering attacks. Evidence now suggests that BlackSuit affiliates have either adopted Black Basta’s strategy or absorbed members of the group. The developer(s) of a previously identified Java malware family, distributed during social engineering attacks, have now been assessed as likely initial access brokers, having potentially provided historical access for Black Basta and/or FIN7 affiliates.
Read more…
Source: Rapid7
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- UK Manufacturers Top Attack Target For Cyber Crooks
May 8, 2018
Manufacturing was the sector most attacked by cyber-criminals in the UK last year, a report from NTT Security has found, mirroring warnings from other agencies including the UK’s National Cyber Security Centre (NCSC) . The firm’s Global Threat Intelligence Report 2018 found that finance was the most targeted sector worldwide, accounting for 26 percent of attacks, including ...
- This malware checks your system temperature to sidestep sandboxing
May 1, 2018
GravityRAT is a Trojan which checks the temperature of a system to detect the presence of virtual machines (VMs) and prevent efforts at analysis by researchers. By taking thermal readings, the Remote Access Trojan (RAT), which has become a recent menace in India, attempts to find out whether or not VMs are being employed for the ...
- New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia
April 23, 2018
Symantec has identified a new attack group dubbed Orangeworm deploying the Kwampirs backdoor in a targeted attack campaign against the healthcare sector and related industries. Symantec has identified a previously unknown group called Orangeworm that has been observed installing a custom backdoor called Trojan.Kwampirs within large international corporations that operate within the healthcare sector in the United States, ...
- Kaspersky Lab Discovers Russian Hacker Infrastructure
April 23, 2018
Compromised servers used by Crouching Yeti/Energetic Bear hacker group found by Kaspersky Lab A hacker collective known for attacking industrial companies around the world have had some of their infrastructure identified by Russian security specialists. Kaspersky Lab said that it has discovered a number of servers compromised by the group, belonging to different organisations based in Russia, ...
- Nearly half of UK manufacturers hit by cyber attacks
April 23, 2018
Nearly half of UK manufacturers have been hit by a cyber security incident, according to a report by an industry organisation, which calls for greater government focus on the specific security needs of the sector Some 48% of UK manufacturers admit they have at some time been subject to a cyber security incident, with half of ...
- Cyber crime now “generates $1.5tn per year”
April 20, 2018
Cyber crime generates $1.5tn (£1.1tn) in revenue every year, according to a groundbreaking report released at RSA Conference on Friday. The research, conducted by Surrey University criminologist Michael McGuire and commissioned by security firm Bromium, reveals that if cyber crime was a country, it would have the 13th highest GDP in the world. According to McGuire’s “conservative ...