BlackBasta

Hello. Who are you in this company? What is your position?

Do you need a private chat?

We are Black Basta Group. We are here to inform that your company local network has been hacked and encrypted. We've downloaded over 110GB of a sensitive information and data from your network.  
Check your page in our blog.  Right now we're keeping it secret. However, if we don't come to an agreement within 10 days, it'll be posted on our news board.
We will let everyone who wants to connect to your network and get all the necessary data from your. 
Decryption price is $400,000.  In case of successful negotiations we guarantee you will get:

1) Decryptor for all your Windows machines;
2) Non recoverable removal of all downloaded data from our side;
3) Security report on how you were hacked to fix your vulnerabilities and avoid such situations in future.

Hope you can correctly assess the risks for your company.
You can find more information about Black Basta Group in Google.

okay

Wait please, we'll send you the list of your taken data.

Download file: [redacted].rar

You can choose any 5 file names from this list and we will send them to you, like a proof.

okay

Yes, this is full list.

Wait please.

Download file: [redacted].rar

These are requested files.

Understood. Wait you on Monday.

You can send some encrypted files, we decrypt them and send back to you. But these files must be unimportant.

okay

Wait please.

Download file: [redacted].jpg

Download file: [redacted].doc

We'll in touch.

10% discount for you and we close the deal.

Okay, we'll be in touch.

Are you seriously? This is an unacceptable offer. We will not even turn our heads in your direction for such a meager amount. Increase it.

We also want to remind you that you have a lot of critical data, a lot of personal data of your employees and customers, copies of passports and driver's license ([redacted] and many others), their SSN, DOB, addresses and phone numbers, your NDA, confidential agreements, financial documents and other documents can be used for bad purposes, loans, etc. Darknet users know how to do this. Therefore, we suggest you to think better and make the worthy offer.

We are ready to help restore all your systems and files to their original state very quickly, but the minimum amount we can accept is $150k. Less payment is not possible. Therefore, tell your manager if he wants to make a deal, then he look for this amount. If not, then further negotiations are pointless.

Okay. We confirm all points. Our BTC wallet is [redacted]

Okay.

Any updates?

Yes, we see the transaction, but it hasn't been confirmed yet. Please wait.

Payment received.

Your data is wiping.

This is log of deletion ALL your taken data
Download: https://qaz.im/load/[redacted]
Delete: https://qaz.im/index.php?a=delete&q=[redacted]

Download file: [redacted].ex

How to decrypt windows?
1. Drop executable to any folder.
2. Start new terminal session with administrator rights. (run cmd.exe or powershell.exe with admin rights)
3.1. In cmd.exe type full path to the executable file and press Enter.
3.2. In powershell.exe type: "& c:\full\path\to\executable.exe" without quotes and press Enter.

OR

1. Drop file.
2. Click right mouse button on the file and press run as admin.


(!) IMPORTANT, READ ALL BEFORE DECRYPTION PROCESS
1. Yoy can decrypt only 1 folder (test decrypt for example)
decrypt.exe -forcepath c:\users\1\Desktop\folder
2. DO NOT CLOSE decryptor yourself
3. MAKE BACKUPS of important files what you will decrypt, then you can rerun decryptor if something happens
4. You can decrypt partially encrypted files:
4.1. Make backup
4.2. Add encrypted extension (random for every company, you can ask in chat) to file
4.3. Run decryptor to folder what contains file
4.4. Now you can test file
5. Every decryption process saves file in same location with name of decrypted file with extension .kbckp. In this file you can find individual chacha keys for better recovery experience.
6. You can ask in chat about ECC keys (used to encrypt chacha keys) for your company.
7. Make sure you have at least 10 gb of free space on each disk.
8. To choose folder on linux decrypt.linux -forcepath /path

Security report and recommendation:
Your network has been compromised by mailing of messages to the emails with malicious attachments. 
One of the users launched malware.
To avoid this in the future, give you recommendations of network protection: 
1. Use sandbox to analyze the contents of letters and their attachments.
2. Use the password security policies  
3. Make protection from attack like a Pass-the-Hash  and Pass-the-ticket attack
4. Update all OS and software to the latest versions, especially Microsoft Defender Antivirus. 
5. Implement the hardware firewalls with filtering policies, modern DLP and IDS, SIEM systems.
6. Block kerberoasting attacks 
7. Conduct full penetrations tests and audit 
8. Use and update Anti-virus/anti-malware and malicious traffic detection software 
9. Configure group policies, disable the default administrators accounts, create new accounts. 
10. Backups. You must have offline backups, does not have access to the network.