Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Black Basta – Email-Bombing Followed by Quick Assist Remote-Access Grant

Blackbasta Initial Access Sentinel
MITRE ATT&CK
Remote Access Tools
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (blackbasta); public ReliaQuest/Rapid7 reporting on Black Basta's Quick Assist social-engineering campaigns
What This Detects
Black Basta's well-documented 2024-2025 initial-access chain floods a target's inbox with spam ('email bombing'), then a caller posing as IT support convinces the user to open Microsoft Quick Assist and grant remote control.
Query
let mailBomb = EmailEvents
| where Timestamp > ago(1d)
| summarize InboundCount = count() by RecipientEmailAddress, bin(Timestamp, 1h)
| where InboundCount > 100;
let quickAssist = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "quickassist.exe"
| project DeviceName, AccountName, QaTime = Timestamp;
mailBomb
| join kind=inner quickAssist on $left.RecipientEmailAddress == $right.AccountName
| where QaTime - Timestamp between (0min .. 4h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.