BlackBasta attacks UCH Logistics

Date:

November 17, 2023

World map

Overview

Title

BlackBasta attacks UCH Logistics

Victim

UCH Logistics

Attacker

BlackBasta

Location

Colnbrook, United Kingdom

Colnbrook, United Kingdom

Size of Attack

Unknown/TBD

First Reported

November 17, 2023

Last Updated

October 31, 2022

The BlackBasta ransomware group has asserted the UCH Logistics ransomware attack in a dark web post. The ransomware group claims to possess a staggering 895 GB of data, including employee files, accounts, human resources records, and even personal documents like passports and driver’s licenses. A sample of the exfiltrated data has been leaked by the BlackBasta group, proving the severity of the situation. UCH Logistics is a prominent provider of specialist transport services in the United Kingdom. BlackBasta is a RaaS that emerged in early 2022 and is assessed by some researchers to be an offshoot of the disbanded Conti and REvil attack groups. The group routinely exfiltrates sensitive data from victims for additional extortion leverage. BlackBasta engages in highly targeted attacks and is assessed to only work with a limited group of highly vetted affiliate attackers. BlackBasta has quickly became one of the most prolific attack groups in 2023 and was observed leveraging unique TTPs for ingress, lateral movement, data exfiltration data, and deployment of ransomware payloads. Ransom demands vary depending on the targeted organization with reports that they can be as high as $2 million dollars. BlackBasta continues to evolve their RaaS platform, with ransomware payloads that can infect systems running both Windows and Linux systems. BlackBasta is particularly adept at exploiting vulnerabilities in VMware ESXi running on enterprise servers. BlackBasta ransomware is written in C++, can target both Windows and Linux systems, encrypts data with ChaCha20, and then the encryption key is encrypted with RSA-4096 for rapid encryption of the targeted network. In some cases, BlackBasta leverages malware strains like Qakbot and exploits such as PrintNightmare during the infection process. BlackBasta also favors abuse of insecure Remote Desktop Protocol (RDP) deployments, one of the leading infection vectors for ransomware. BlackBasta typically targets manufacturing, transportation, construction and related services, telecommunications, the automotive sector, and healthcare providers. BlackBasta also employs a double extortion scheme and maintains an active leaks website where they post exfiltrated data if an organization declines to pay the ransom demand.

Oh no!

This attack's description was not found, while we work on the detailed account of this attack we invite you to browse through other recent Rasomware Attacks in the table below.

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.

8Base attacks YRW Limited
Date
February 7, 2024
Ransomware group
8Base
Location

Tauranga, New Zealand

, New Zealand

Industry
Professional, Scientific & Technical Services
Victim
YRW Limited
8Base attacks YRW Limited
Date
February 7, 2024
Ransomware group
8Base
Location

Tauranga, New Zealand

, New Zealand

Industry
Professional, Scientific & Technical Services
Victim
YRW Limited
LockBit attacks Vimar Equipment
Date
February 7, 2024
Ransomware group
LockBit
Location

Burnaby, Canada

British Colombia, Canada

Industry
Manufacturing
Victim
Vimar Equipment
LockBit attacks Vimar Equipment
Date
February 7, 2024
Ransomware group
LockBit
Location

Burnaby, Canada

British Colombia, Canada

Industry
Manufacturing
Victim
Vimar Equipment
8Base attacks CERALP
Date
February 7, 2024
Ransomware group
8Base
Location

Villefranche sur Saône, France

Rhone, France

Industry
Professional, Scientific & Technical Services
Victim
CERALP
8Base attacks CERALP
Date
February 7, 2024
Ransomware group
8Base
Location

Villefranche sur Saône, France

Rhone, France

Industry
Professional, Scientific & Technical Services
Victim
CERALP
Cactus attacks SPB Globa
Date
February 6, 2024
Ransomware group
Cactus
Location

Huévar del Aljarafe, Spain

Seville, Spain

Industry
Manufacturing
Victim
SPB Global
Cactus attacks SPB Globa
Date
February 6, 2024
Ransomware group
Cactus
Location

Huévar del Aljarafe, Spain

Seville, Spain

Industry
Manufacturing
Victim
SPB Global
Play attacks Virgin Islands Lottery
Date
February 6, 2024
Ransomware group
Play
Location

St Thomas,

,

Industry
Other
Victim
Virgin Islands Lottery
Play attacks Virgin Islands Lottery
Date
February 6, 2024
Ransomware group
Play
Location

St Thomas,

,

Industry
Other
Victim
Virgin Islands Lottery
Black Basta attacks Asecos
Date
February 6, 2024
Ransomware group
BlackBasta
Location

Gründau, Germany

, Germany

Industry
Other
Victim
Asecos
Black Basta attacks Asecos
Date
February 6, 2024
Ransomware group
BlackBasta
Location

Gründau, Germany

, Germany

Industry
Other
Victim
Asecos
LockBit attacks Logtainer
Date
February 5, 2024
Ransomware group
LockBit
Location

Milan, Italy

, Italy

Industry
Transportation & Warehousing
Victim
Logtainer
LockBit attacks Logtainer
Date
February 5, 2024
Ransomware group
LockBit
Location

Milan, Italy

, Italy

Industry
Transportation & Warehousing
Victim
Logtainer
LockBit attacks Portline
Date
February 5, 2024
Ransomware group
LockBit
Location

Lisbon, Portugal

, Portugal

Industry
Transportation & Warehousing
Victim
Portline
LockBit attacks Portline
Date
February 5, 2024
Ransomware group
LockBit
Location

Lisbon, Portugal

, Portugal

Industry
Transportation & Warehousing
Victim
Portline
LockBit attacks TGestiona Logistica Company
Date
February 5, 2024
Ransomware group
LockBit
Location

Sertãozinho Maua, Brazil

, Brazil

Industry
Transportation & Warehousing
Victim
TGestiona Logística Company
LockBit attacks TGestiona Logistica Company
Date
February 5, 2024
Ransomware group
LockBit
Location

Sertãozinho Maua, Brazil

, Brazil

Industry
Transportation & Warehousing
Victim
TGestiona Logística Company
LockBit attacks Prima
Date
February 5, 2024
Ransomware group
LockBit
Location

Fresno,

California,

Industry
Agriculture
Victim
Prima
LockBit attacks Prima
Date
February 5, 2024
Ransomware group
LockBit
Location

Fresno,

California,

Industry
Agriculture
Victim
Prima