Leaks Expose BlackBasta’s Supporting Infrastructure and China-Linked KnownSec Espionage Pipeline
Threat Actor Intelligence · 2 sources · Updated 5mo ago · First seen Jan 19, 2026
Two major leak-driven investigations detailed how criminal and state-aligned cyber operations are enabled by supporting ecosystems. Internal chat logs attributed to the BlackBasta ransomware group—reportedly ~200,000 messages in a leaked JSON archive—were followed by a separate database leak tied to Media Land, which investigators linked to Yalishanda, a long-running bulletproof hosting provider allegedly used to support ransomware infrastructure (including server configurations, customer records, user accounts, and cryptocurrency wallet data). Separately, a large leak from Beijing-based security firm KnownSec was reported to expose a “vertically integrated” contractor model supporting China’s Ministry of Public Security, including the ZoomEye internet intelligence platform integrated with a classified “TargetDB” and references to offensive tooling (e.g., GhostX) used for reconnaissance, intrusion, and persistence.
Other items in the set were not about these leak-driven exposures and instead covered unrelated topics: a PR firm’s Wikipedia manipulation (disinformation), a Citizen Lab job posting, generic ransomware resilience guidance, a general cyber-attacks timeline, a vendor’s 2026 threat landscape outlook, a law-enforcement disruption of a ransomware crew in Ukraine/Germany, a podcast on vulnerability management/incident response, an Olympics cybersecurity risk report, German legislative proposals expanding BND hacking/surveillance powers, and a malware-newsletter link roundup. Those references do not materially add to the specific story of the BlackBasta/Yalishanda infrastructure leaks or the KnownSec leak and should be treated as separate reporting streams.
