Black Basta ransomware group developed its own automated brute-forcing framework

Analysis of internal Black Basta chat logs that had leaked online in February 2025 revealed the existence of this malicious framework. BRUTED simplifies the initial access to networks for hackers and makes it possible to scale ransomware attacks on vulnerable endpoints. According to experts, Black Basta has been using BRUTED since 2023 to deliver massive credential-stuffing and brute-forcing attacks.

Source code analysis showed that the framework is specially designed to brute-force credentials in the following products: SonicWall NetExtender, Palo Alto GlobalProtect, Cisco AnyConnect, Fortinet SSL VPN, Citrix NetScaler (Citrix Gateway), Microsoft RDWeb (Remote Desktop Web Access), and WatchGuard SSL VPN.

The framework discovers publicly accessible edge network devices that match its target list by enumerating subdomains, resolving IP addresses, and adding prefixes like vpn and remote. Information about matches is transmitted to the remote command-and-control server.

After identifying potential targets, the frameworks gathers password candidates from a remote server, combines them with locally generated guesses, and performs bulk authentication attempts using multiple CPU processes. Special query headers and tailored user-agent strings are used for each target device.

To generate additional password guesses, BRUTED extracts common names (CN) and Subject Alternative Names (SAN) from a target’s SSL certificate getCertDomainsList().

To avoid detection, the framework uses multiples SOCKS5 proxies (all from the domain fuck-you-usa[.]com) while performing high volume of brute-forcing requests. Its three servers are registered under Proton66 (AS 198953) and located in Russia.

Experts believe that tools like BRUTED make ransomware easier to operate; as a result, hackers infiltrate multiple networks with minimal effort, which accelerates monetization.

The key protection strategy against such threats involves strong and unique passwords for all edge devices and VPN accounts, as well as multifactor authentication (MFA) that blocks access even in situations when the credentials were compromised.