http://ransomlookumjrc6erzqn467lkcu2t5h4enjzfigvsxrrktxicysi2yd.onion/group/blackbasta
Initial access vectors include exploitation of known vulnerabilities (e.g., QakBot infections, ZeroLogon, PrintNightmare), phishing, and purchasing credentials from Initial Access Brokers. By mid-2024, BlackBasta was among the top five most active ransomware groups worldwide. External Analysis https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a https://www.sentinelone.com/labs/blackbasta-ransomware-group-an-analysis/...