club1337

#Lasarus

@club31337

$1M / year for an exclusive subscription to a loader servicing BlackBasta ransomware

“Bro, as you know, we recently decided that we are going private. And after a few weeks of thinking, we finally came to this decision, for those who still use our loader for mass loading (especially you, like you, locker drivers).

I will offer you such a solution, for 1 year of use (on all 3 of your partners), you can pay $1,000,000. And it will be exclusively for you, with constant cleaning from us).

I understand that you work with a locker called "Black Basta". So that's why we decide that $1kk is a decent amount for your operation.”

#BlackBasta #ransomware

@club31337

Leaked BlackBasta chat logs contain messages spanning from September 18, 2023, to September 28, 2024. Let's analyze the statements disclosed by the leaker:

- Lapa is one of the key administrators of BlackBasta and is constantly busy with administrative tasks. Holding this high-trust position, Lapa is frequently insulted by his boss, who persistently demands major changes. The role causes Lapa significant stress, yet he earns significantly less compensation compared to others in the group. It appears that ransom payments might be an additional source of income for him to support his family during these difficult times. Under his administration, there was a brute force attack on the infrastructure of some Russian banks. So far, no actions seem to have been taken by law enforcement, suggesting that this situation could pose a serious problem and potentially provoke reactions from these authorities.

- "Cortes" is associated with the Qakbot group, which had dealings with Americans last year, likely attracting the attention of intelligence services. When BlackBasta conducted these attacks on Russian banks, "Cortes" distanced himself from these actions, probably surprised that this Russian group would target its own country. This might be why Qakbot didn't participate in the attacks against Russia.

- "YY" is also a main administrator of BlackBasta, seemingly very busy with support tasks and receives a good salary. The arrest of BlackBasta’s leader creates significant risks for the remaining members of the group. It turns out that the personal financial interests of Oleg, the group's boss, dictate the operations, disregarding the team's interests. Under his administration, there was also a brute force attack on the infrastructure of some Russian banks It seems that no measures have been taken by law enforcement, which could present a serious problem and provoke reactions from these authorities.

- When "Trump" and "Bio" worked together in Conti, disputes over fees issues were common. Bio is paid more in his current position to continue managing such high-level risks. Bio changed his nickname from "bio" to "pumba" while working at Conti, but has now reverted to his old nickname in BlackBasta, so his reputation in BlackBasta should not be associated with the nickname "pumba". The recent arrest of "Bio" and the police's treatment likely caused concern among the BlackBasta group members.

- Bio identifies "GG" as "Trump". It can be inferred that "GG", "AA", and "Trump" are all aliases used by Oleg Nefedov, the group's boss.

cc 3xp0rt

#BlackBasta #ransomware

@club31337

UI vulnerability in #Microsoft #Windows exploited by #Chinese #APT group - #Mustang #Panda.

When files are extracted from compressed “RAR” files they are hidden from the user. If the compressed files are extracted into a folder, the folder appears empty in the Windows #Explorer GUI.

When using the "dir" command to list all files and folders inside the target folder, the extracted files and folders are "invisible/hidden" to the user.

TAs or users can also execute those compressed files from a command line prompt, if they know the exact path.
As a result of executing "attrib -s -h" to system protected files, an unknown file type is created from the type "Unknown" #ActiveX component.

@club31337