BlackBasta attacks Hymer
Incident Date:
April 19, 2024
Overview
Title
BlackBasta attacks Hymer
Victim
Hymer
Attacker
Blackbasta
Location
First Reported
April 19, 2024
The BlackBasta Ransomware Group Targets Hymer
Overview
The BlackBasta ransomware group has added Hymer to its list of victims, a major motorhome and caravan manufacturer in Europe. The company owns several well-known brands, including Burstner, Carado, Sunlight, and more.
Background
Black Basta is a Ransomware-as-a-Service (RaaS) group that emerged in early 2022. Some researchers believe it is linked to the disbanded Conti and REvil attack groups. Black Basta is known for exfiltrating sensitive data from victims to use as leverage for extortion.
Attack Tactics
Black Basta conducts highly targeted attacks and collaborates with a select group of affiliate attackers. The group has become one of the most prolific ransomware groups, with ransom demands reportedly reaching up to $2 million. It is estimated that Black Basta has made over $107 million in ransom revenue from more than 90 victims in less than two years.
Technical Details
Black Basta's ransomware is written in C++ and can target both Windows and Linux systems. It encrypts data using ChaCha20 and then encrypts the encryption key with RSA-4096 for rapid network encryption. The group also leverages malware strains like Qakbot and exploits vulnerabilities such as PrintNightmare.
Targeted Sectors
Black Basta typically targets industries such as manufacturing, transportation, construction, telecommunications, automotive, and healthcare. The group favors exploiting vulnerabilities in VMware ESXi and insecure Remote Desktop Protocol (RDP) deployments.
Double Extortion Scheme
Black Basta employs a double extortion scheme, where they threaten to leak exfiltrated data on an active leaks website if the ransom demand is not met. The group continues to evolve its RaaS platform with new ransomware payloads to infect a wide range of systems.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.