Black Basta Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (11)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	12

Country

US: USA	8
RU: Russia	2
CN: China	2

Actors

Black Basta	2
RedLine Stealer	1
Moobot	1

Activities

Interest

Timeline

Type

Not Defined	4
Chip Software	2
Content Management System	2
SCADA Software	2

Vendor

Qualcomm	2
Joomla	2
Web Wiz	2
Not Defined	2
Nordex	2

Product

Qualcomm Snapdragon Mobile	2
Qualcomm Snapdragon Compute	2
Qualcomm Snapdragon Auto	2
Qualcomm Snapdragon IOT	2
Qualcomm Snapdragon Connectivity	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Web Wiz Guestbook access control	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00852	0.03	CVE-2003-1571
2	cpLinks sql injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00312	0.00	CVE-2008-2180
3	Nordex Control 2 SCADA Wind Farm Portal Application cross site scripting	4.3	4.1	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00159	0.03	CVE-2015-6477
4	SWsoft Plesk Login login.php3 path traversal	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01630	0.03	CVE-2007-2268
5	Qualcomm Snapdragon Mobile Sahara Protocol buffer overflow	5.5	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00069	0.09	CVE-2021-30327
6	Magento sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.17175	0.02	CVE-2019-7139
7	Microsoft Windows LDAP Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00687	0.04	CVE-2022-29130
8	Joomla CMS index.php sql injection	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00135	0.00	CVE-2010-4696
9	Dodos Scripts dodosmail dodosmail.php file inclusion	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.15956	0.00	CVE-2006-5841
10	Matomo safemode.twig Path information disclosure	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00105	0.00	CVE-2019-12215

Campaigns (3)

These are the campaigns that can be associated with the actor:

IOC - Indicator of Compromise (101)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	5.62.43.252	r-252-43-62-5.consumer-pool.prcdn.net	Black Basta		03/07/2023	verified	High
2	5.196.124.228	ip228.ip-5-196-124.eu	Black Basta		03/07/2023	verified	High
3	5.199.162.220		Black Basta		11/20/2024	verified	Very High
4	23.26.137.225		Black Basta	CVE-2024-1708 / CVE-2024-1709	01/24/2025	verified	Very High
5	23.81.246.84		Black Basta		11/20/2024	verified	Very High
6	23.106.160.188		Black Basta		07/30/2022	verified	Medium
7	23.227.178.65	23-227-178-65.static.hvvc.us	Black Basta		11/20/2024	verified	Very High
8	24.49.232.96	24-49-232-96.resi.cgocable.ca	Black Basta	Qbot	11/23/2022	verified	Low
9	24.64.114.59	S0106b06ebfd79790.cg.shawcable.net	Black Basta	Qbot	11/23/2022	verified	Low
10	24.178.196.44	024-178-196-044.biz.spectrum.com	Black Basta		10/05/2022	verified	Medium
11	37.186.54.185		Black Basta		10/05/2022	verified	Medium
12	39.44.144.182		Black Basta		10/05/2022	verified	Medium
13	45.63.1.88	45.63.1.88.vultrusercontent.com	Black Basta		10/05/2022	verified	Low
14	45.67.229.148	renoldgavrilov93.example.com	FIN7	Black Basta	11/08/2022	verified	Medium
15	45.87.154.208	vm1075965.stark-industries.solutions	Black Basta		03/07/2023	verified	High
16	45.133.216.39	vm627637.stark-industries.solutions	Black Basta		03/07/2023	verified	High
17	45.153.241.167		Black Basta		03/07/2023	verified	High
18	46.22.211.151	ns6.printembrace.com	Black Basta		12/27/2023	verified	High
19	46.166.161.68		Black Basta		11/20/2024	verified	Very High
20	46.166.161.93		Black Basta		11/20/2024	verified	Very High
21	46.176.222.241	ppp046176222241.access.hol.gr	Black Basta		10/05/2022	verified	Low
22	XX.XX.XX.XXX	xxx-xxxxxxxx.xxxxxx.xxxxxxxxx.xxx	Xxxxx Xxxxx		10/05/2022	verified	Medium
23	XX.XX.XX.XXX	xx-xx-xx-xxx.xxxxxx.xxxx.xx	Xxxxx Xxxxx		03/07/2023	verified	High
24	XX.XX.X.XXX	xxxx-xxxx-xxxxxxxxxxx-xxx-xx-xx-xx-x-xxx.xxx.xxxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
25	XX.XX.XX.XXX	xxxxxxxxxxxxxxxxx.xx.xxxxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
26	XX.XX.XXX.XX	xx-xx-xxx-xx.xxxx.xxxxxxxxxxxx.xxx	Xxxxx Xxxxx		10/05/2022	verified	Medium
27	XX.XX.XX.XX	xxxx-xx-xx-xx-xx.xxxxxx.xxxx.xxxxxxx.xxx	Xxxxx Xxxxx		10/05/2022	verified	Medium
28	XX.XXX.XXX.XX		Xxxxx Xxxxx		10/05/2022	verified	Medium
29	XX.XXX.XXX.XXX		Xxxxx Xxxxx		10/05/2022	verified	Medium
30	XX.XX.XXX.XXX	x-xx-xx-xxx-xxx.xxxx.xx.xxxxxxx.xxx	Xxxxx Xxxxx		10/05/2022	verified	Medium
31	XX.XX.XXX.XXX	x-xx-xx-xxx-xxx.xxxx.xx.xxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
32	XX.XX.XXX.XX	xx-xx-xxx-xx.xxx.xxxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
33	XX.XX.XXX.XX	xxx-xxxxxxxx.xxxxxx.xxxxxxxxx.xxx	Xxxxx Xxxxx		10/05/2022	verified	Medium
34	XX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxx.xxxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
35	XX.X.XXX.XXX	xxxx-xx-x-xxx-xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
36	XX.XXX.XXX.XXX	xx-xxx-xxx.xxxxxxxx.xxx	Xxxxx Xxxxx		03/07/2023	verified	High
37	XX.XX.XX.XXX	xxxxxxxxx-xxxxxx-x-x-xxxxxxx.xx-x.xxxxx.xxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
38	XX.XX.XXX.XXX	xxxx-xx-xx-xxxxx-xxxxxx-xxxxxxx.xxx.xxxxx.xxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
39	XX.XXX.XXX.XX	xxxxxxxxxxx-xxx-x-xxx-xx.xxx-xxx.xxx.xxxxxxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
40	XX.XXX.XX.XX	xx-xx.xxx.xx.xx.xxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
41	XX.XXX.XXX.X	xxxxxx-xxx-xxx-x.xxxxxxx-xxx.xxxxxxxxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
42	XX.XXX.XX.XX	xx.xx.xxx.xx.xxxxxxx.xxxxxxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
43	XX.XXX.XXX.XXX	xx.xxx.xxx.xxx.xxxxxxxxx-xxx	Xxxxx Xxxxx		03/07/2023	verified	High
44	XX.XX.XX.XXX	xxxx-xxx-x-xxxx-xxx.xxx-xx.xxx.xxxxxxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
45	XX.XXX.XXX.XX	xx-xxx-xxx-xx.xxxx.xxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
46	XX.XXX.XXX.XXX	xxx.xxxxxx-xxx-xxx.xxxxxxx.xxxxxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
47	XX.XXX.XXX.XXX		Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
48	XX.XXX.XX.XXX		Xxxxx Xxxxx		11/20/2024	verified	Very High
49	XX.XXX.XX.XX		Xxxxx Xxxxx		11/20/2024	verified	Very High
50	XX.XX.XX.XXX	xxxxxxx-xxxxxxx.xxxx.xxxxxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
51	XX.XXX.XXX.XXX	xx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxx		03/07/2023	verified	Medium
52	XX.XXX.XXX.XX		Xxxxx Xxxxx		03/07/2023	verified	High
53	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxx.xx.xx	Xxxxx Xxxxx		10/05/2022	verified	Medium
54	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxx.xxx.xxxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
55	XXX.XX.XXX.XXX	xxxxxx-xxx-xx-xxx-xxx.xxxxxxxxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
56	XXX.XXX.XXX.XX		Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
57	XXX.XXX.X.XXX	xxxxxxx.x.xxx.xxxx.xx	Xxxxx Xxxxx		03/07/2023	verified	High
58	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
59	XXX.XX.X.XXX		Xxxxx Xxxxx		10/05/2022	verified	Medium
60	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxx.xx-x.xxxx-xxxx.xxxx.xx.xxxxx.xxxxxxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
61	XXX.XXX.XXX.XXX	xxxx-xxx-xxx-xxx.xxxxxx.xxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
62	XXX.XX.XXX.XXX		Xxxxx Xxxxx		02/23/2024	verified	High
63	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxx		03/07/2023	verified	Medium
64	XXX.XXX.XX.XXX	xxxxxxxxxxx-xxxx-xxx-xx-xxx.xxxxxxx.xxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
65	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
66	XXX.XX.XX.XX		Xxxxx Xxxxx		02/23/2024	verified	High
67	XXX.XX.XX.XXX		Xxxxx Xxxxx		11/20/2024	verified	Very High
68	XXX.X.XX.XX	xx.xx.x.xxx.x.xxx.xxxxx.xxx.xx	Xxxxx Xxxxx		10/05/2022	verified	Medium
69	XXX.XXX.XX.XXX		Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
70	XXX.XX.XX.XXX		Xxxxx Xxxxx		11/20/2024	verified	Very High
71	XXX.XX.XXX.XXX		Xxxxx Xxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxx	02/28/2024	verified	Very High
72	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		02/23/2024	verified	High
73	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
74	XXX.XX.XXX.XXX		Xxxxx Xxxxx		10/05/2022	verified	Medium
75	XXX.XXX.XX.XX		Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
76	XXX.XX.XXX.XXX	xxx-xxx-xx-xxx-xxx.xxxxx.xxx.xx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
77	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxx.xxxx.xxx.xx.xxx	Xxxxx Xxxxx		10/05/2022	verified	Medium
78	XXX.XXX.XX.XX	xxxxxxxxxxxxxxx-xxxxxxxxxxxxxx.xxx.xxx.xxxxx.xxxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
79	XXX.XX.XXX.XX	xx-xxx-xx-xxx-xx.xx.xxxxxxxx.xx	Xxxxx Xxxxx		03/07/2023	verified	High
80	XXX.XX.XXX.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
81	XXX.XXX.XX.XX	xx.xx.xxx.xxx.xxxxxxx.xx.xxx.xx	Xxxxx Xxxxx		10/05/2022	verified	Medium
82	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxx.xxxxxxxxxx.xx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Medium
83	XXX.XX.XX.XX		Xxxxx Xxxxx		03/07/2023	verified	High
84	XXX.XXX.XX.XX		Xxxxx Xxxxx		03/07/2023	verified	High
85	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxx.xxxx.xxx	Xxxxx Xxxxx		03/07/2023	verified	High
86	XXX.XXX.X.XX		Xxxxx Xxxxx		03/07/2023	verified	High
87	XXX.XXX.XX.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
88	XXX.XXX.XX.XXX	xxxx.xxxxxxxxxxxxxx.xxxx	Xxxxx Xxxxx		03/07/2023	verified	High
89	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		10/05/2022	verified	Medium
90	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxx		11/20/2024	verified	High
91	XXX.XX.XX.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
92	XXX.XX.XX.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
93	XXX.XX.XX.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
94	XXX.XXX.X.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
95	XXX.XXX.XXX.XXX	xxxxxxxxxxx.xxxxxxxx.xxx	Xxxxx Xxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxx	02/28/2024	verified	Very High
96	XXX.XX.XX.XXX	xxx.xx.xx-xxx.xxx.xxx.xxxxx.xxx	Xxxxx Xxxxx	Xxxx	11/23/2022	verified	Low
97	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxx	02/28/2024	verified	High
98	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxxx.xxxx.xx	Xxxxx Xxxxx		11/20/2024	verified	Very High
99	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxx		03/07/2023	verified	Medium
100	XXX.XXX.XXX.XXX		Xxxxx Xxxxx		03/07/2023	verified	High
101	XXX.XXX.XXX.XX	xxxxxxxxxxxxxx-xxx-x-x-xx.xxxx-xxx.xxx.xxxxxxx.xx	Xxxxx Xxxxx		10/05/2022	verified	Medium

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	TXXXX.XXX	CAPEC-XXX	CWE-XX	Xxxxx Xxxxx Xxxx Xxxxxxxxx	predictive	High
3	TXXXX		CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (7)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	dodosmail.php	predictive	High
2	File	index.php	predictive	Medium
3	File	xxxxx.xxxx	predictive	Medium
4	File	xxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxxx	predictive	High
5	Argument	xxxxx_xxxxxxxx	predictive	High
6	Argument	xxxxxx_xxxxx_xxx	predictive	High
7	Argument	xxxxxx_xx	predictive	Medium

References (10)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!