Rapid7 reports an interesting social engineering scheme that easily bypasses content filtering defenses and creatively uses a fake help desk to supposedly “help” users put down the attack.
The Black Basta ransomware group, also covered in a recent CISA warning bulletin, floods a victim’s email inbox with many, many emails. The emails are often otherwise legitimate emails, such as newsletter confirmation emails, which most email content filtering gateways would not block. The ransomware gang then makes contact with the victim, pretends to be the victim’s legitimate IT help desk, and offers help.
That help includes the “help desk’s” need to install legitimate remote management software. The attacker then uses the remote access to install other malware and to compromise other systems. Like most ransomware groups, the end objective often includes encrypted files, operational interruption and exfiltrated data.
Defenses
Defenses include:
- Educate your users about these types of tactics.
- Educate users to report incidents of mass email spam flooding to IT security operations, even if emails appear to be legitimate or are made up of spam versus traditional phishing lures.
- Ensure all users understand how your IT department would contact them and how remote control assistance would be performed if needed.
- As Rapid7 recommends, it can’t hurt to blocklist common remote management software services so they cannot be used in unauthorized connections.
Security awareness training includes making all users aware of the many types of social engineering schemes. Black Basta adds one more scenario that users should be aware of.
Here's how it works:
