Loading threat actor…
National Hazard Agency is a cybercriminal grouping associated with the ransomware affiliate and access-broker persona Bassterlord. The name appears to have been used both as a group identifier on underground profiles and as branding for ransomware activity linked to customized LockBit-derived operations. Available reporting indicates the group was involved in malicious spamming, ransomware enablement, and intrusion activity within the broader Russian-speaking cybercrime ecosystem. The group is tied to Bassterlord’s early recruitment into cybercrime, where he said a person using the National Hazard Agency nickname hired him for malicious spam operations and taught ransomware tradecraft, including compromise of remote access infrastructure. Later activity attributed to the name suggests use of a modified LockBit builder after the LockBit builder leak in 2022, with custom ransom notes replacing standard LockBit branding and infrastructure. In that form, the operation reportedly threatened repeated attacks and resale or transfer of victim access to other criminals rather than emphasizing data theft. National Hazard Agency is best understood as part of the ransomware affiliate ecosystem rather than a standalone top-tier ransomware brand. Its known associations overlap with actors and ecosystems connected to LockBit, REvil, Ransomexx, and Avaddon through Bassterlord’s claimed relationships and operational history. The broader activity set linked to Bassterlord includes access brokerage, sale of compromised corporate access, phishing and spam-based initial access, and participation in ransomware intrusions against organizations in multiple countries. Reporting also places Bassterlord in the Russian-controlled Luhansk region of Ukraine, which is the strongest geographic clue available for the group’s operating environment. High-confidence characterization of National Hazard Agency itself remains limited. The most defensible assessment is that it functioned as a cybercriminal team or label used in ransomware-related operations, with capabilities spanning initial access, persistence, post-compromise activity, and extortion-oriented deployment of customized ransomware tooling.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.