Leaked Black Basta Chats Expose Use Of Bruted Framework To Target Edge Network Devices

On February 11, 2025, a Russian-speaking Telegram user (@ExploitWhispers) leaked internal chat logs from Black Basta members, exposing their tactics, techniques, and infrastructure. The leak revealed that Black Basta has developed and deployed an automated brute-forcing framework, named BRUTED, to compromise edge network devices, such as firewalls and VPNs.

Severity Level: High

THREAT OVERVIEW

1. Inside the Black Basta Leak:

• The leak exposed operational tactics, member roles, and internal conflicts, causing disruptions within the group. The exposure likely weakened Black Basta’s infrastructure, leading some members to defect to rival ransomware groups. The leak was reportedly retaliation for Black Basta’s breaches of Russian financial institutions.

2. Inside Their Brute-Force Attack Infrastructure:

• Leaked chat messages revealed previously unknown brute-force infrastructure (BRUTED) used by Black Basta.
• Key brute-force attack servers identified:
• 45.140.17[.]40, 45.140.17[.]24, 45.140.17[.]23 (used for large-scale credential stuffing).
• These servers experienced downtime but were later renewed for extended operations.
• The infrastructure was registered under Proton66 (AS 198953) in Russia, suggesting an operational security (OPSEC) strategy to evade Western law enforcement.
• Conversations exposed @GG (Black Basta’s leader), previously known as tramp, who had ties to the Conti RaaS group.
• The group maintained multiple redundant servers to sustain continuous brute-force operations.

3. Capabilities of BRUTED:

• Mass internet scanning for vulnerable VPNs, firewalls, and remote access systems.
• Credential stuffing and brute-force attacks using stolen or weak passwords.
• Proxy rotation via a SOCKS5 network (fuck-you-usa[.]com) to evade detection.
• Target-specific attack logic for various VPN and remote-access solutions (e.g., SonicWall, Fortinet, Cisco AnyConnect, Citrix, RDWeb).
• Certificate-based password generation, extracting SSL certificate details to create likely password combinations.
• Reporting and logging of brute-force results to a command-and-control (C2) server.

4. How Black Basta Expands from Edge Devices to Full Network Takeover:

• Initial access via edge device brute-forcing or credential theft.
• Deployment of post-exploitation tools (Cobalt Strike, Brute Ratel) to establish command-and-control (C2) channels.
• Lateral movement using Active Directory enumeration, RDP hijacking, and PsExec.
• Privilege escalation and disabling security tools to maintain access.
• Execution of ransomware payloads on ESXi hypervisors, cloud storage, and network shares.
• Data exfiltration and ransom demands, leveraging double extortion tactics.

5. Industries Affected:

• Business Services, Industrial Machinery, Manufacturing, Retail, Construction, Financial, HealthCare, Legal, Real Estate, Architecture, Food & Beverage, Logistics, Energy, Engineering, Technology.

Recommendations:

1. Apply security patches for firewalls, VPNs, and remote access solutions immediately to mitigate known vulnerabilities.
2. Enforce strong, unique passwords for all edge devices and VPN accounts.
3. Implement password complexity requirements to prevent brute-force and credential-stuffing attacks.
4. Mandate regular password rotation, especially for privileged accounts.
5. Implement geo-blocking to prevent access from unauthorized regions.
6. Turn off unnecessary remote management services such as Telnet, FTP, or outdated SNMP versions.
7. Disable default accounts that are not needed.
8. Use role-based access control (RBAC) to limit administrative privileges.
9. Avoid using company names, domains, or predictable words in SSL certificate fields.
10. Use generic, non-descriptive values for Common Name (CN) and Subject Alternative Names (SAN) instead of exposing internal service names.
11. Block the IOCs at their respective controls.

SOURCES:

• https://www.virustotal.com/gui/collection/49abf55330d77a5118400c19ea95ef2db1f3d60bd0d0cf62c7c7592c3a620ef0/iocs
• https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
• https://www.zerodayinitiative.com/advisories/ZDI-25-148/

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.