How Black Basta turned OSINT data into a breach playbook | #ransomware | #cybercrime

COMMENTARY: Earlier this year, leaked internal chat logs from the Black Basta ransomware group revealed how attackers used public data to profile companies, identify vulnerable infrastructure, and quietly gain access — all before launching a single malicious payload.Their approach was strikingly methodical. Affiliates started with tools like ZoomInfo to filter potential targets based on size, industry, and revenue. Once a company was flagged as a high-value target, they turned to LinkedIn to map out the org chart and analyze job postings to understand what technologies were in use. From there, they used contact enrichment platforms RocketReach and SignalHire to gather email addresses, just like a sales team would when prospecting.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]But it didn’t stop with employee data. Using Shodan and FOFA, the group scanned the internet for exposed infrastructure: VPN portals, Citrix instances, vulnerable appliances like SonicWall or Fortinet, and cloud services like Jenkins or ESXi.In some cases, they already had leaked credentials from previous breaches, which let them log-in without triggering any alarms. This wasn’t a zero-day exploit or an insider job. It was a textbook example of how attackers can weaponize Open-Source Intelligence (OSINT).

How attackers use OSINT

Security pros use OSINT to collect and analyze publicly available information to generate actionable intelligence. While it’s a powerful tool for cybersecurity teams and investigators, it’s also a go-to technique for attackers during the early stages of a breach.From company blogs and public repos to social media posts and leaked credentials, OSINT gives threat actors everything they need to understand how an organization operates and where it might be exposed. Black Basta didn’t invent this method. They just used it well and they’re not alone.While OSINT comes from countless sources, it generally falls into four main categories:

What security teams can do today

Reducing an organization’s digital footprint takes effort, but it’s one of the most effective ways to slow down attackers and disrupt reconnaissance. Start with these steps:For everyone:

For security teams:

The Black Basta case should serve as a wake-up call. We don’t need a zero-day exploit when people and systems expose everything attackers need.Security isn’t just about patching systems or deploying the latest toolset: it’s also about awareness, digital hygiene, and making it harder for adversaries to gather the intel they rely on. Reducing the organization’s public exposure and detecting early signs of compromise, especially across identity, network, and cloud, isn’t optional: It’s the new baseline for defense.Lucie Cardiet, cyberthreat research manager, Vectra AISC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.