A joint advisory from the FBI, CISA, HHS and MS-ISAC says Black Basta affiliates flood a target's inbox with spam, then phone or message staff posing as IT support and ask them to install a remote access tool. The advisory names healthcare among at least 12 of 16 critical infrastructure sectors affected.
What the advisory says
Black Basta is a ransomware as a service variant first identified in April 2022. As of May 2024 affiliates had hit over 500 organizations across North America, Europe and Australia. The advisory was published on 10 May 2024 and updated on 8 November 2024.
It says healthcare is attractive because of technology dependence, personal health data and the effect of disrupted patient care. It does not give a healthcare specific victim count.
The social engineering sequence
From May 2024 the actors flooded users with spam, then called while posing as IT support, asking them to install tools such as AnyDesk or Microsoft Quick Assist. In October 2024 the same approach moved to Microsoft Teams, with messages from external accounts posing as support.
Other entry routes in the advisory include spearphishing, exploitation of a ConnectWise vulnerability from February 2024 and valid credentials.
What defenders can do
- Block or restrict remote access tools that you do not use, and secure the ones you do.
- Configure Teams so external accounts cannot message staff unless needed.
- Tell staff plainly that IT will never ask them to install a tool because of a spam flood.
- Give staff one easy way to report a suspicious call or message.
- Require phishing resistant MFA, starting with privileged accounts, as the advisory recommends.
Technical controls from the advisory
It recommends prompt patching with priority for the Known Exploited Vulnerabilities catalog, offline or protected backups, asset inventories, modern email security, and testing controls against the techniques it lists. Agencies advise against paying ransoms, since payment does not guarantee recovery.
A staff script
Give your help desk a rule: they never initiate contact asking someone to install software. If staff get such a call, they hang up and call the published help desk number. Rehearse it once and record the date.
Safeguard's vulnerability management and fix PRs address the patching side, and it is off by default with every category on Manual. It does not provide EDR, so pair it with your endpoint tooling.
Click through it at your own pace, or open it full screen.
Measure whether it works
Send a safe internal test: a spam flood followed by a call from an unknown number offering help. Count how many people follow the script and call the help desk instead. Share the result without blame and repeat in a quarter. The number you want to see rise is the share of staff who report the contact, not only the share who resist it.
Quick check
What is email bombing?
Flooding someone with spam so they welcome a call from fake IT support offering to fix it.
Should staff ever install a tool on a caller's request?
No. They should hang up and use the help desk number they already know.
Sources
Last reviewed: 19 October 2026.
