The BlackBasta Ransomware Group Targets Hymer

Overview

The BlackBasta ransomware group has added Hymer to its list of victims, a major motorhome and caravan manufacturer in Europe. The company owns several well-known brands, including Burstner, Carado, Sunlight, and more.

Background

Black Basta is a Ransomware-as-a-Service (RaaS) group that emerged in early 2022. Some researchers believe it is linked to the disbanded Conti and REvil attack groups. Black Basta is known for exfiltrating sensitive data from victims to use as leverage for extortion.

Attack Tactics

Black Basta conducts highly targeted attacks and collaborates with a select group of affiliate attackers. The group has become one of the most prolific ransomware groups, with ransom demands reportedly reaching up to $2 million. It is estimated that Black Basta has made over $107 million in ransom revenue from more than 90 victims in less than two years.

Technical Details

Black Basta's ransomware is written in C++ and can target both Windows and Linux systems. It encrypts data using ChaCha20 and then encrypts the encryption key with RSA-4096 for rapid network encryption. The group also leverages malware strains like Qakbot and exploits vulnerabilities such as PrintNightmare.

Targeted Sectors

Black Basta typically targets industries such as manufacturing, transportation, construction, telecommunications, automotive, and healthcare. The group favors exploiting vulnerabilities in VMware ESXi and insecure Remote Desktop Protocol (RDP) deployments.

Double Extortion Scheme

Black Basta employs a double extortion scheme, where they threaten to leak exfiltrated data on an active leaks website if the ransom demand is not met. The group continues to evolve its RaaS platform with new ransomware payloads to infect a wide range of systems.