Microsoft Threat Intelligence Podcast Black Basta and the Use of LLMs by Threat Actors
Aug 28, 2024
Anna Seitz and Daria Pop, both Microsoft security researchers, delve deep into the world of ransomware and cyber threats. They discuss the Black Basta ransomware group’s evolution from simple phishing to sophisticated social engineering tactics, including malware distribution via Microsoft Teams. The duo highlights the persistence of malvertising and its implications for cybersecurity. They reveal how state-sponsored actors are leveraging large language models, emphasizing the dual nature of AI as both a tool for security and a weapon for attackers.
AI Snips
Chapters
Transcript
Episode notes
BlackBasta’s Evolving Tactics
- BlackBasta ransomware operators have shifted their initial access tactics over time.
- They evolved from phishing and malware like Quakbot to social engineering and RMM tools like Quick Assist.
Malvertising Persistence
- Malvertising persists due to the complex ad traffic supply chain.
- This makes it difficult to track who bought and sold the malicious ad traffic.
Mitigating Quick Assist Risks
- Disable unused remote management monitoring (RMM) tools if they're not actively needed.
- Be aware of tech support scams, Microsoft never asks for device access out of the blue.