← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Social Engineering Campaign Linked to Black Basta Ransomware Operators | Rapid7 Blog
WHITE Armature_TIP 2025-02-22 Modified: 2025-03-24
18
IOCs
MEDIUM VOLUME
managed detection and response (mdr)detection and responseransomwareemergent threat responseincident responserapid7cobalt strikec2 serverpowershellanydeskimpacketcommandquick assistblack bastait teamaprilservicevoiceshellexecutionenterprise
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (18)
All CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain
TYPEINDICATORDESCRIPTIONCREATED
CVE CVE-2025-0282 — 2025-02-22
FileHash-MD5 580ba62ea52551e50a6e4d1f8e49d630 MD5 of 35456f84bc88854f16e316290104d71a1f350e84b479eebd6fbb2f77d36bca8a 2025-02-22
FileHash-MD5 6615ea2fa3b879d27687a7ce917e93b0 MD5 of 6f31cf7a11189c683d8455180b4ee6a60781d2e3f3aadf3ecc86f578d480cfa9 2025-02-22
FileHash-SHA1 73bf648fa87bdd26ed2a161be7e3fbd6300eb826 SHA1 of 35456f84bc88854f16e316290104d71a1f350e84b479eebd6fbb2f77d36bca8a 2025-02-22
FileHash-SHA1 8d4f19b221751297b0c3a10f105772d7286c9411 SHA1 of 6f31cf7a11189c683d8455180b4ee6a60781d2e3f3aadf3ecc86f578d480cfa9 2025-02-22
FileHash-SHA256 2ec12f4ee375087c921be72f3bd87e6e12a2394e8e747998676754c9e3e9798e — 2025-02-22
FileHash-SHA256 35456f84bc88854f16e316290104d71a1f350e84b479eebd6fbb2f77d36bca8a — 2025-02-22
FileHash-SHA256 59f1c5fe47c1733b84360a72e419a07315fbae895dd23c1e32f1392e67313859 — 2025-02-22
FileHash-SHA256 6f31cf7a11189c683d8455180b4ee6a60781d2e3f3aadf3ecc86f578d480cfa9 — 2025-02-22
FileHash-SHA256 76f959205d0a0c40f3200e174db6bb030a1fde39b0a190b6188d9c10a0ca07c8 — 2025-02-22
FileHash-SHA256 a47718693dc12f061692212a354afba8ca61590d8c25511c50cfecf73534c750 — 2025-02-22
FileHash-SHA256 c18e7709866f8b1a271a54407973152be1036ad3b57423101d7c3da98664d108 — 2025-02-22
domain greekpool.com — 2025-02-22
domain limitedtoday.com — 2025-02-22
domain rewilivak13.com — 2025-02-22
domain thetrailbig.net — 2025-02-22
domain upd7.com — 2025-02-22
domain upd7a.com — 2025-02-22
References (1)
↗ https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators/