Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Black Basta – Email-Bombing Followed by Quick Assist Remote-Access Grant

Blackbasta Initial Access Sentinel
MITRE ATT&CK
Remote Access Tools
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (blackbasta); public ReliaQuest/Rapid7 reporting on Black Basta's Quick Assist social-engineering campaigns
What This Detects
Black Basta's well-documented 2024-2025 initial-access chain floods a target's inbox with spam ('email bombing'), then a caller posing as IT support convinces the user to open Microsoft Quick Assist and grant remote control.
Query
let mailBomb = EmailEvents
| where Timestamp > ago(1d)
| summarize InboundCount = count() by RecipientEmailAddress, bin(Timestamp, 1h)
| where InboundCount > 100;
let quickAssist = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "quickassist.exe"
| project DeviceName, AccountName, QaTime = Timestamp;
mailBomb
| join kind=inner quickAssist on $left.RecipientEmailAddress == $right.AccountName
| where QaTime - Timestamp between (0min .. 4h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.