Black Basta Ransomware
, active since April 2022, is back to hit Italian institutions and businesses. Like all ransomware, this is a type of malware that, once introduced into an organization, encrypts the data, requiring the victim to pay a ransom in order to decrypt it.
TG Soft Cyber Security Specialist's
CRAM researchers could test their Heuristic Behavioral technologies to combat even the variants of this family type of Ransomware attacks. Again these technologies, developed since 2014 and made available since 2015, proved to be effective and efficient in blocking the cyber attack, started in any mode, automatically within 100 milliseconds {1 tenth of a second => a blink of an eye} from the start of the encryption process.
It is worth to point out that the file encryption process was locked automatically without the signature of the file initiating the process...if the signature had been loaded, the encrypted files would have been 0 {zero}!
Below is some payload info from TG Soft's CRAM Analysts on BlackBasta Ransomware.
BlackBasta ransomware encrypted file structure:
| [<ORIGINAL_FILE_NAME>.<ORIGINAL_EXTENSION>.basta |
As we can see, the ransomware adds the extension ''basta'' after the original file extension.
Below is an image of the
readme.txt file, that is generated by cyber criminals, and contains instructions to start the payment negotiation through web chat, accessible through the link provided with custom login.
From the attack we simulated in our own real infrastructure with a sample retrieved from an actual attack, the heuristic-behavioral protection of VirITeXplorerPRO AntiRansomware CryptoMalware protection intervened in 100 milliseconds {1/10th of a second} from the start of the encryption process, when the ransomware managed to encrypt only 12 files (by the way, all decoy files), saving from encryption 99.94% of the files on the PC / Server. Therefore, since only decoy files have been encrypted, it saved 100% of the user's files.
The computer where the malicious process was initiated (simulating a HumanOperatedRansomware Attack), was automatically isolated from the rest of the network by our technologies, so as to prevent the ransomware attack from propagating to the entire infrastructure and thus saving on average 99.99% of the user's working files on that machine (client or server indifferently).
Vir.IT Anti-Ransomware Crypto-Malware Protection
TG Soft has been developing and integrating since May 2015 in the Vir.IT eXplorer PRO suite - THE ONLY product with proprietary engine developed 100% in Italy - AntiVirus, AntiSpyware and AntiMalware, AntiRansomware Crypto-Malware protection technologies that, through the heuristic-behavioral approach, block the encryption process in the initial phase of the attack saving, on average, at least 99.63% of the data files otherwise potentially encrypted.
In addition, as a last parachute, you can restore from
Vir.IT BackUp, which is built in Vir.IT eXplorer PRO suite, data files that cannot be restored or recovered using other restore/recovery tools.
For more info on these technologies, 100% developed in Italy, you can contact the administrative office of TG Soft Cyber Security Specialist by writing to
segreteria@tgsoft.it or by calling the direct number 049.8977432.
C.R.A.M.
TG Soft's Anti-Malware Research Center
