Black Basta affiliates turned a flooded inbox and a friendly call from "the help desk" into hands-on access, persuading employees to open Quick Assist or a Teams screen share before deploying ransomware. This profile draws on the joint #StopRansomware advisory AA24-131A (updated November 2024), MITRE ATT&CK v20, Microsoft Threat Intelligence, Rapid7, Sophos and law enforcement statements from January 2026. It covers names and aliases, targeting, techniques mapped to ATT&CK, how affiliates abuse identities and credentials, and the Teams, remote support and detection controls that break the chain. It is for security operations, collaboration platform and service desk teams; attribution follows each source's wording and the page contains no leak-site material.
Key takeaways
- The help desk impersonation is the pivot. Since May 2024, affiliates have flooded inboxes with spam (T1667 Email Bombing) and then called or messaged users as IT support (T1566.004, T1566.003) to get a remote session approved.
- Microsoft Teams external access is part of the attack surface. Microsoft and Sophos describe chats and calls from attacker-created tenants with names such as "Help Desk"; Teams allows all external domains by default.
- Legitimate support tools carry the intrusion. Quick Assist, AnyDesk, ScreenConnect, NetSupport Manager and renamed OpenSSH appear in the sources; blocking unused tools removes the step the caller needs.
- Old Active Directory flaws still matter. The advisory lists ZeroLogon, NoPac and PrintNightmare for privilege escalation, plus ConnectWise ScreenConnect CVE-2024-1709 for initial access.
- Scale and law enforcement. The advisory counted over 500 affected organisations by May 2024 across 12 of 16 US critical infrastructure sectors; in January 2026 German and Ukrainian authorities announced action against the group's alleged members.
Who they are (names and aliases)
MITRE ATT&CK tracks Black Basta as ransomware software (S1070) offered as ransomware-as-a-service since at least April 2022, with Windows and VMware ESXi variants. ATT&CK notes that researchers assess the operators could include current or former members of Conti, based on similarities in techniques, leak and payment sites and negotiation tactics. The social engineering cluster is tracked separately, so keep the two apart in reporting.
| Name or ID | Source | What it refers to |
|---|---|---|
| Black Basta (S1070) | MITRE ATT&CK, AA24-131A | The ransomware and the RaaS operation; affiliates run the intrusions |
| Storm-1811 (G1046) | MITRE ATT&CK, Microsoft | Financially motivated cluster linked to Black Basta deployment, known for email bombing followed by fake help desk contact |
| CURLY SPIDER | Microsoft naming table | Listed by Microsoft as another name for Storm-1811 |
| STAC5777 | Sophos | Activity cluster that overlaps with Storm-1811; Black Basta was deployed in one case |
Law enforcement: on 15 January 2026 the Cyber Police of Ukraine announced searches, with Germany's BKA and Europol taking part, of two suspects alleged to have cracked password hashes for the group, and said the alleged organiser, a Russian citizen, had been placed on Interpol's wanted list at the initiative of the BKA and Frankfurt prosecutors. As reported by The Hacker News, the BKA named an alleged leader and added him to the EU Most Wanted list. These are allegations, not convictions. See the Threat Actor Groups Guide for how vendor naming schemes relate.
Targeting and motivation
- Motivation: financial, through double extortion. The advisory says the ransom note holds no demand; it gives a unique code and a Tor site, and victims typically have 10 to 12 days before data is published.
- Scale: over 500 organisations affected globally as of May 2024, with encryption and data theft in at least 12 of 16 US critical infrastructure sectors, across North America, Europe and Australia (AA24-131A). Ukrainian police describe hundreds of organisations and losses in the hundreds of millions of euros between 2022 and 2025.
- Healthcare: the advisory was released with a healthcare focus and states that "Healthcare organizations are attractive targets for cybercrime actors". Media reports, citing unnamed sources, linked the May 2024 Ascension attack to Black Basta; Ascension's own statements in the sources read did not name the group.
- Selection: Rapid7 notes that when a user refused to install remote software, the caller simply moved to the next target, so any organisation whose staff can be reached by phone or external Teams chat is in scope.
See the Ransomware Groups Guide for how Black Basta relates to Conti, Akira and other operations.
Tactics and techniques (MITRE ATT&CK)
All IDs are ATT&CK v20 entries recorded against S1070 or G1046, or named in AA24-131A. The impersonation technique now sits at T1684.001; defence impairment techniques sit under tactic TA0112.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Impact (as a lure) | T1667 Email Bombing | Thousands of newsletter sign-ups; Sophos saw up to 3,000 messages in under an hour | Volume anomaly alerts; tell users the next step is a fake support call |
| Resource development | T1585.003 Cloud Accounts; T1036.010 Masquerade Account Name | Attacker Microsoft 365 tenants with display names such as "Help Desk" and "IT Support" | Restrict Teams external access to allowed domains |
| Initial access | T1566.004 Spearphishing Voice; T1566.003 Spearphishing via Service | Phone calls and Teams chats or calls posing as IT support | Published support channels; call-back verification |
| Stealth | T1684.001 Impersonation | Help desk and IT staff impersonated to obtain a remote session | User training on how real IT will make contact |
| Command and control | T1219.002 Remote Desktop Software | Quick Assist (S1209), AnyDesk, ScreenConnect, NetSupport Manager, Splashtop | Remove or block unused remote support tools |
| Credential access | T1056 Input Capture | A PowerShell prompt disguised as a login for an "update" captured the user's password | Script controls; EDR on PowerShell credential prompts |
| Persistence | T1547.001 Registry Run Keys | Run keys keeping reverse SSH tunnels alive | Alert on Run keys pointing at user-writable paths |
| Initial access | T1190 Exploit Public-Facing Application | ConnectWise ScreenConnect CVE-2024-1709 from February 2024 | Patch KEV-listed remote support servers |
| Privilege escalation | T1068 Exploitation for Privilege Escalation | ZeroLogon CVE-2020-1472, NoPac CVE-2021-42278 and CVE-2021-42287, PrintNightmare CVE-2021-34527 | Patch domain controllers; disable Print Spooler on DCs |
| Lateral movement | T1570 Lateral Tool Transfer; T1021.002 SMB/Windows Admin Shares | PsExec, Impacket, BITSAdmin and Cobalt Strike | ASR rule blocking PsExec and WMI process creation |
| Defence impairment | T1688 Safe Mode Boot; T1685 Disable or Modify Tools | Reboot into safe mode with networking; PowerShell to disable antivirus and Backstab to disable EDR | Alert on bcdedit safeboot changes; tamper protection |
| Exfiltration and impact | T1567.002; T1486; T1490 | Rclone and WinSCP; ChaCha20 with RSA-4096, .basta extension, readme.txt note; vssadmin shadow copy deletion | Egress controls; immutable backups |
How they abuse identities and credentials
Human identities and trust in IT support
- The user approves the access: Microsoft explains that the victim must accept screen sharing and then a control request in Quick Assist, which is why the caller needs to sound like the organisation's own IT team. Nothing technical is bypassed at this stage. See the Vishing and Smishing Guide.
- Passwords captured in the session: Rapid7 describes scripts presented as updates that prompt for the user's password and send it to the attacker. A user who has already accepted a remote session will usually type it.
- Session token theft: Microsoft reports EvilProxy adversary-in-the-middle pages used to capture credentials and session tokens, which defeats MFA based on one-time codes or push approval. The advisory recommends phishing-resistant MFA (FIDO/WebAuthn or PKI). See the Phishing-Resistant MFA Guide.
- Real help desk resets: the same impersonation skills apply to calls into the genuine service desk. See the Account Recovery and Help Desk Security Guide and, for a different actor using the same pretext, the Storm-2949 Azure attack.
Machine identities and directory secrets
- Domain controller trust: ZeroLogon abuses the Netlogon secure channel used by machine accounts, and NoPac abuses machine account naming to obtain domain admin tickets. Both turn a single foothold into domain control on unpatched DCs.
- Password hashes: Ukrainian police describe suspects whose role was cracking hashes to extract passwords, then using employee credentials to expand privileges. Long, unique passwords and removing NTLM where possible raise the cost. See the Credential Dumping Guide.
- Remote management agents: ScreenConnect and NetSupport installs give the attacker a persistent identity inside a tool many teams already trust. See the RMM Tool Security Guide.
Notable incidents
| When | Incident or campaign | What sources describe |
|---|---|---|
| April 2022 | First identified | AA24-131A and ATT&CK date Black Basta RaaS activity to April 2022 |
| February 2024 | ScreenConnect exploitation | Affiliates exploited CVE-2024-1709 for initial access (AA24-131A) |
| April to May 2024 | Email bombing and vishing | Rapid7 (from late April) and Microsoft (from mid-April) describe spam floods followed by IT support calls and Quick Assist or AnyDesk sessions, then QakBot, Cobalt Strike and Black Basta via PsExec |
| May 2024 | Ascension (reported) | Media reports citing unnamed sources linked the Ascension hospital outage to Black Basta; the joint advisory issued the same day does not name Ascension |
| Late May and October 2024 | Teams as the channel | Microsoft saw Teams messages and calls from attacker tenants at the end of May 2024; the advisory update notes external Teams accounts from October 2024 |
| Late 2024 | STAC5777 | Sophos investigations into Teams vishing with Quick Assist; Black Basta deployed in one case and blocked in another |
| January 2026 | Law enforcement action | Searches in Ukraine and an international wanted notice for the alleged leader |
Detection and defence
Phased response for a defender
- First week: publish how IT will contact staff (and that it will never ask them to start Quick Assist unprompted), and give users a one-click way to report suspicious calls and chats.
- Restrict Teams external access: in the Teams admin center under Users, External access, move from Allow all external domains to Allow only specific external domains, or block unmanaged Teams accounts. With PowerShell, Set-CsTenantFederationConfiguration takes -AllowedDomains, -BlockedDomains and -AllowTeamsConsumer. Pilot with one business unit, list partner domains first, and keep the previous configuration to roll back.
- Remove unused remote support tools: uninstall or block Quick Assist where Intune Remote Help or another approved tool is used; block unapproved RMM binaries and domains with WDAC or AppLocker, starting in audit mode.
- Patch the listed flaws: ScreenConnect CVE-2024-1709, then confirm DCs are patched for ZeroLogon, NoPac and PrintNightmare, and disable the Print Spooler on domain controllers.
- Harden endpoints: enable tamper protection and the ASR rules Microsoft lists, including "Block process creations originating from PSExec and WMI commands" and "Block execution of potentially obfuscated scripts".
- Exercise: run a simulated email bomb followed by a Teams call from a test external tenant, and measure who reports and how fast the SOC responds.
What to log and alert on
| Signal | Source | Why it matters |
|---|---|---|
| Sudden inbound email volume to one mailbox | Email security logs; Microsoft's EmailEvents hunting query | The email bomb usually precedes the call by minutes |
| One-to-one Teams chats from external tenants with help desk-style names | Microsoft 365 audit log; CloudAppEvents | The lure itself; correlate with process events on the same user's device |
| quickassist.exe, AnyDesk, ScreenConnect or NetSupport launched by a user who rarely uses them | EDR process telemetry; Defender alert "Suspicious activity using Quick Assist" | The moment control is handed over |
| Renamed OpenSSH binaries, Run keys and reverse SSH connections | EDR, Sysmon, firewall | Rapid7's persistence pattern |
| bcdedit setting safeboot; vssadmin deleting shadows | EDR, Sysmon | Late-stage defence impairment and recovery inhibition |
Metrics that show it is working
- Report rate: share of staff who report a simulated fake support call or Teams chat.
- External Teams exposure: number of external domains allowed, trending down to a reviewed list.
- Remote tool sprawl: count of distinct remote support tools seen on endpoints against the approved list.
- Time to contain: minutes from a Quick Assist alert to host isolation.
- Phishing-resistant MFA coverage: percentage of privileged and remote access accounts on FIDO2 or certificate-based authentication.
Decision guidance
Organisations that rarely collaborate in Teams with outsiders should allow only specific domains; those with heavy external collaboration can keep broader access but block unmanaged accounts and invest in the chat detection above. Small teams without a SOC benefit most from removing Quick Assist and unapproved RMM tools, because that step needs no monitoring. See the Social Engineering Guide.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Social engineering awareness | AT-2(3) | PR.AT-01 |
| Remote access and support tools | AC-17, CM-7(5) | PR.PS-02 |
| Phishing-resistant MFA | IA-2(1) | PR.AA-03 |
| Patch DCs and remote support servers | SI-2, RA-5 | ID.RA-01 |
| Monitoring for lures and tools | SI-4, AU-6 | DE.CM-01 |
| Protected backups | CP-9 | PR.DS-11 |
Practitioner checklist
- Tell staff exactly how IT will contact them and how to report a suspicious call or chat.
- Limit Teams external access to allowed domains or block unmanaged Teams accounts.
- Remove or block Quick Assist where another approved remote support tool exists.
- Block unapproved RMM tools and their domains with application control.
- Alert on inbound email floods and correlate them with external Teams contact.
- Patch ScreenConnect CVE-2024-1709 and confirm DCs are patched for ZeroLogon, NoPac and PrintNightmare.
- Enable tamper protection and the PsExec/WMI and obfuscated script ASR rules.
- Move privileged and remote access accounts to phishing-resistant MFA.
- Keep immutable or offline backups and test restores.
Standards and references
- FBI, CISA, HHS and MS-ISAC: #StopRansomware: Black Basta (AA24-131A)
- MITRE ATT&CK: Black Basta (S1070)
- MITRE ATT&CK: Storm-1811 (G1046)
- Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
- Microsoft Learn: Manage external access in Microsoft Teams
- Rapid7: Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators
- Sophos: Sophos MDR tracks two ransomware campaigns using email bombing and Microsoft Teams vishing
- Cyber Police of Ukraine: Members of an international hacker group exposed and organiser identified
Related NHI Mgmt Group resources: Ransomware Groups Guide · Threat Actor Groups Guide · Akira Threat Actor Profile · Scattered Spider Threat Actor Profile · RMM Tool Security Guide