Black Basta
Black Basta is a Russia-linked ransomware-as-a-service group active from early 2022 until its internal chat logs were leaked in February 2025. It is described as a ransomware gang that emerged rapidly in April 2022, compromising at least a dozen companies within weeks, targeting organizations worldwide, and using double extortion: stealing corporate data before encrypting systems and threatening publication on its Tor leak site, referred to as the "Black Basta Blog" or "Basta News," with negotiations conducted through a separate "Chat Black Basta" portal. Reported victims and impacts in the provided content include Capita, where the group compromised Microsoft Office 365 and accessed personal data of staff and clients. Observed Black Basta tradecraft in the provided content includes targeted email bombing followed by phone- or Microsoft Teams-based help desk impersonation, often persuading victims to install remote access tools such as AnyDesk or use Quick Assist. Multiple reports state this social-engineering pattern became strongly associated with former Black Basta affiliates and continued after the group’s internal conflict and collapse in early 2025. The content also links former Black Basta affiliates or derived crews to rapid Teams-vishing intrusions, sometimes progressing from contact to malicious execution in as little as 12–20 minutes. Technical behaviors attributed to Black Basta ransomware in the content include requiring administrative privileges, deleting Volume Shadow Copies via vssadmin, hijacking an existing Windows service, rebooting systems into Safe Mode with Networking before encryption, dropping readme.txt ransom notes, changing the desktop wallpaper, appending the .basta extension to encrypted files, and using ChaCha20 for file encryption with RSA-4096 to protect encryption keys. The content also notes Black Basta among ransomware families observed targeting VMware ESXi environments. The provided content repeatedly connects Black Basta to the broader Conti ecosystem. It states that after Conti disbanded, members rebranded into subgroups including Zeon, Black Basta, and Quantum, with Quantum later becoming Royal and then BlackSuit. Some reporting cited in the content speculated Black Basta may have been a Conti rebrand based on similarities in negotiation style and leak-site behavior, but that linkage is presented as unconfirmed. The content further states that Black Basta’s leaked internal chats in early 2025 exposed operational structure, internal conflicts, and figures such as Tramp, after which affiliates dispersed to other groups including Chaos, INC, Lynx, Cactus, and Nokoyawa. Related successor or affiliate-linked activity in the content includes BlackSuit and crews tracked as former Black Basta affiliates.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
53 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Associated vulnerabilities
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
↑のプロセスを脆弱なNsecSoft NSecKrnlドライバで止める CVE-2025-68947に関連するNsecSoft NSecKrnlドライバでサービス作成を試みて、そのサービスで脆弱性悪用によりカーネルレベルからプロセスキルや検知機能阻害を行う感じ。
Black Basta attempts local and domain level privilege escalation through a variety of exploits. We have seen the use of ZeroLogon (CVE-2020-1472)... There are two versions of the ZeroLogon exploit in use: an obfuscated version dropped as zero22.exe and a non-obfuscated version dropped as zero.exe.
We have seen the use of ... PrintNightmare (CVE-2021-34527). In one intrusion, we observed the Black Basta operator exploiting the PrintNightmare vulnerability and dropping spider.dll as the payload.
We have seen the use of ... NoPac (CVE-2021-42287, CVE-2021-42278) ... for privilege escalation.
We have seen the use of ... NoPac (CVE-2021-42287, CVE-2021-42278) ... for privilege escalation.
1 more CVE tied to this actor tracked in Mallory.
Observables
13 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as contextual reference for internal conflict tied to later BlackSuit affiliate activity involving Nimbus RAT; not explicitly identified as the actor behind the current campaign.
Referenced as the source of broader derived crews continuing to use Microsoft Teams vishing, email bombing, and Quick Assist-based social engineering for initial access.
A ransomware group whose collapse in early 2025, following leaked internal chats, triggered affiliate dispersion across competing groups and contributed to fragmentation of the ransomware ecosystem.
Referenced by The Gentlemen as another ransomware operation whose negotiation practices and code-signing abuse techniques were studied and potentially adapted.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.