Hybrid Attack Bulletin:  Uncovering Salt Typhoon - The Silent Storm in Telco Cyberattacks >

Vectra AI Japan、ITR発行の最新レポート内「NDR市場」にて国内トップシェアを獲得
詳細を見る
Hamburger icon top line
Hamburger icon middle line
Hamburger icon bottom line
Threat actors
>
Ransomware Group

Bashe

Bashe, a ransomware group formerly known as APT73 or Eraleig, emerged in 2024 with tactics resembling LockBit, targeting critical industries across developed nations and leveraging data extortion through a Tor-based Data Leak Site (DLS).

Detect Bashe's TTPs
Is Your Organization Safe from Bashe's Attacks?
Background
Targets
TTPs
Detection
FAQs
Watch Threat Briefing

The origin of Bashe

Bashe, previously known as APT73 and Eraleig Ransomware, emerged in mid-April 2024, initially self-identifying as an "Advanced Persistent Threat" (APT). This self-designation, commonly reserved for highly sophisticated and well-resourced cyber actors, appears to be part of Bashe’s strategy to market itself as a credible threat. It is believed Bashe spun off from the LockBit ransomware group, based on the similarities between their Data Leak Sites (DLS). Bashe’s DLS structure includes “Contact Us,” “How to Buy Bitcoin,” “Web Security Bug Bounty,” and “Mirrors” sections, identical to those seen in LockBit’s setup.

Bashe operates through the Tor network with infrastructure hosted in the Czech Republic. It relies on AS9009 ASN for hosting, a network previously used by several malicious groups and malware, including DarkAngels, Vice Society, TrickBot, Meduza Stealer, and Rimasuta. This choice of infrastructure suggests Bashe may be leveraging familiar systems to evade detection.

The origin of Bashe
Targets

Bashe's targets

Countries targeted by Bashe

The group’s activities have reportedly impacted organizations across North America, the United Kingdom, France, Germany, India, and Australia. Bashe's focus on developed nations with valuable data assets highlights its global approach to maximizing victimization potential.

Image source: ransomware.live

Industries targeted by Bashe

Bashe appears to prioritize high-value sectors, including technology, business services, manufacturing, consumer services, and financial services. The group also targets transportation, logistics, healthcare, and construction. Focusing on these industries allows Bashe to maximize its leverage for ransom demands by targeting sectors handling sensitive or essential data.

Industries targeted by Bashe

Bashe appears to prioritize high-value sectors, including technology, business services, manufacturing, consumer services, and financial services. The group also targets transportation, logistics, healthcare, and construction. Focusing on these industries allows Bashe to maximize its leverage for ransom demands by targeting sectors handling sensitive or essential data.

Bashe's victims

Bashe has breached about 35 victims so far.

Attack Method

Initial Access
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Execution
Exfiltration
Impact
A shadowy figure casting a wide net over a digital landscape filled with various devices such as computers, smartphones, and tablets. The net symbolizes the attacker's attempts to find vulnerabilities or use phishing techniques to gain unauthorized access.
A digital ladder extending upwards from a basic user icon towards a crown symbolizing administrative privileges. This represents the attacker's efforts to gain higher-level access within the system.
A chameleon blending into a digital background, with zeroes and ones flowing around it. This represents the attacker's ability to avoid detection by security measures, changing tactics to blend in with normal network traffic.
A thief with a lockpick toolkit working on a giant keyhole shaped like a login form, representing the attacker's efforts to steal user credentials to gain unauthorized access.
A magnifying glass moving over a digital map of a network, highlighting files, folders, and network connections. This image represents the phase where attackers explore the environment to understand the structure and where valuable data resides.
A series of interconnected nodes with a shadowy figure moving stealthily between them. This illustrates the attacker's movements within the network, seeking to gain control of additional systems or spread malware.
A large vacuum sucking up files, data icons, and folders into a bag held by a shadowy figure. This image symbolizes the process of gathering valuable data from the target network.
A command prompt window open in front of a digital background, with malicious code being typed out. This represents the phase where attackers execute their malicious payload within the compromised system.
A series of files being funneled through a covert channel out of a computer to a cloud labeled with a skull, symbolizing the unauthorized transfer of data to a location controlled by the attacker.
A cracked screen with a digital cityscape in chaos behind it, symbolizing the destructive impact of the cyberattack, such as service disruption, data destruction, or financial loss.
A shadowy figure casting a wide net over a digital landscape filled with various devices such as computers, smartphones, and tablets. The net symbolizes the attacker's attempts to find vulnerabilities or use phishing techniques to gain unauthorized access.
Initial Access
A digital ladder extending upwards from a basic user icon towards a crown symbolizing administrative privileges. This represents the attacker's efforts to gain higher-level access within the system.
Privilege Escalation
A chameleon blending into a digital background, with zeroes and ones flowing around it. This represents the attacker's ability to avoid detection by security measures, changing tactics to blend in with normal network traffic.
Defense Evasion
A thief with a lockpick toolkit working on a giant keyhole shaped like a login form, representing the attacker's efforts to steal user credentials to gain unauthorized access.
Credential Access
A magnifying glass moving over a digital map of a network, highlighting files, folders, and network connections. This image represents the phase where attackers explore the environment to understand the structure and where valuable data resides.
Discovery
A series of interconnected nodes with a shadowy figure moving stealthily between them. This illustrates the attacker's movements within the network, seeking to gain control of additional systems or spread malware.
Lateral Movement
A large vacuum sucking up files, data icons, and folders into a bag held by a shadowy figure. This image symbolizes the process of gathering valuable data from the target network.
Collection
A command prompt window open in front of a digital background, with malicious code being typed out. This represents the phase where attackers execute their malicious payload within the compromised system.
Execution
A series of files being funneled through a covert channel out of a computer to a cloud labeled with a skull, symbolizing the unauthorized transfer of data to a location controlled by the attacker.
Exfiltration
A cracked screen with a digital cityscape in chaos behind it, symbolizing the destructive impact of the cyberattack, such as service disruption, data destruction, or financial loss.
Impact
MITRE ATT&CK Mapping

TA0001: Initial Access
No items found.
TA0002: Execution
No items found.
TA0003: Persistence
No items found.
TA0004: Privilege Escalation
No items found.
TA0005: Defense Evasion
No items found.
TA0006: Credential Access
No items found.
TA0007: Discovery
No items found.
TA0008: Lateral Movement
No items found.
TA0009: Collection
No items found.
TA0011: Command and Control
No items found.
TA0010: Exfiltration
No items found.
TA0040: Impact
No items found.
Platform Detections

How to Detect ransomware attacks with Vectra AI

While Bashe’s Tactics, Techniques, and Procedures (TTPs) remain under research, we can assess probable activities based on its similarities to LockBit. Here is an outline of the Vectra AI detections that will be triggered in the event of a typical ransomware attack:

AWS Ransomware S3 Activity

M365 Ransomware

Ransomware File Activity

View more detections
Assess your attack exposure

FAQs

Is Your Organization Safe from Bashe's Attacks?

Assess your attack exposure