DNS Early Detection - Breaking the Black Basta Ransomware Kill Chain | Infoblox
Tags
cmtmf-attack-pattern: Command And Scripting Interpreter Exploit Public-Facing Application Masquerading
country: Australia
maec-delivery-vectors: Watering Hole
attack-pattern: Data Direct Model Command And Scripting Interpreter - T1623 Data Encrypted For Impact - T1471 Data Encrypted For Impact - T1486 Disable Or Modify Tools - T1562.001 Disable Or Modify Tools - T1629.003 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Exploitation For Privilege Escalation - T1404 Exploit Public-Facing Application - T1377 Impair Defenses - T1562 Impair Defenses - T1629 Inhibit System Recovery - T1490 Malvertising - T1583.008 Masquerading - T1655 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Tool - T1588.002 Whois - T1596.002 Command-Line Interface - T1059 Exploit Public-Facing Application - T1190 Exploitation For Privilege Escalation - T1068 Masquerading - T1036 Powershell - T1086 Exploit Public-Facing Application Masquerading
Show in Graph
Common Information
Type Value
UUID 1190ef1d-e1ad-4516-afa1-72ac70169a9d
Fingerprint a2d80cd90e1f9dea
Analysis status DONE
Considered CTI value 2
Text language
Published Aug. 1, 2024, 3 p.m.
Added to db Aug. 31, 2024, 1:52 a.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline DNS Early Detection – Breaking the Black Basta Ransomware Kill Chain
Title DNS Early Detection - Breaking the Black Basta Ransomware Kill Chain | Infoblox
Detected Hints/Tags/Attributes 92/4/59
Source URLs
Redirection Url
Details Source https://blogs.infoblox.com/threat-intelligence/dns-early-detection-breaking-the-black-basta-ransomware-kill-chain/
URL Provider
Details Provider Source level domain
Details infoblox.com blogs.infoblox.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 61 ✔ Infoblox Blog https://blogs.infoblox.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 1 
cve-2024-1700
Details Domain 5 
trailshop.net
Details Domain 3 
artstrailman.com
Details Domain 5 
realbumblebee.net
Details Domain 3 
trackgroup.net
Details Domain 5 
recentbee.net
Details Domain 3 
businessprofessionalllc.com
Details Domain 5 
investrealtydom.net
Details Domain 3 
securecloudmanage.com
Details Domain 5 
webnubee.com
Details Domain 3 
oneblackwood.com
Details Domain 5 
artspathgroup.net
Details Domain 3 
buygreenstudio.com
Details Domain 5 
buyblocknow.com
Details Domain 3 
onedogsclub.com
Details Domain 6 
startupbusiness24.net
Details Domain 5 
wipresolutions.com
Details Domain 5 
magentoengineers.com
Details Domain 3 
recentbeelive.com
Details Domain 5 
limitedtoday.com
Details Domain 3 
trailcocompany.com
Details Domain 5 
kekeoamigo.com
Details Domain 3 
trailcosolutions.com
Details Domain 5 
nebraska-lawyers.com
Details Domain 3 
artstrailreviews.com
Details Domain 5 
tomlawcenter.com
Details Domain 3 
topglobaltv.com
Details Domain 5 
thesmartcloudusa.com
Details Domain 3 
startupmartec.net
Details Domain 5 
rasapool.net
Details Domain 3 
jenshol.com
Details Domain 5 
artspathgroupe.net
Details Domain 3 
simorten.com
Details Domain 5 
specialdrills.com
Details Domain 3 
investmentgblog.net
Details Domain 5 
thetrailbig.net
Details Domain 3 
protectionek.com
Details Domain 3 
otxcarecosmetics.com
Details Domain 14 
www.infoblox.com
Details Domain 36 
media.defense.gov
Details Domain 469 
www.cisa.gov
Details Domain 4 
blogs.infoblox.com
Details File 345 
vssadmin.exe
Details File 384 
www.inf
Details File 4 
dns_uoo117652-21.pdf
Details File 10 
blogs.inf
Details MITRE ATT&CK Techniques 409 
T1566
Details MITRE ATT&CK Techniques 542 
T1190
Details MITRE ATT&CK Techniques 208 
T1068
Details MITRE ATT&CK Techniques 348 
T1036
Details MITRE ATT&CK Techniques 298 
T1562.001
Details MITRE ATT&CK Techniques 460 
T1059.001
Details MITRE ATT&CK Techniques 276 
T1490
Details MITRE ATT&CK Techniques 472 
T1486
Details Url 4 
https://www.infoblox.com/threat-intel
Details Url 3 
https://www.infoblox.com/products/bloxone-threat-defense
Details Url 4 
https://media.defense.gov/2021/mar/03/2002593055/-1/-1/0/csi_protective
Details Url 2 
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a
Details Url 1 
https://blogs.infoblox.com/threat-intelligence/black-basta-anatomy-of-the-attack