Loading story…
Threat intelligence reporting identifies Bassterlord as a prolific ransomware affiliate and initial access broker who allegedly worked with REvil, RansomEXX, Avaddon, and LockBit while building a reputation on Russian-language underground forums. Researchers say he used exploited Pulse Secure VPN access tied to CVE-2019-11510 to obtain and sell entry into victim networks, including government, university, and corporate environments. A leaked archive containing credentials and operational notes for more than 900 compromised Pulse Secure servers reportedly exposed how such access was cataloged, assessed for usability, and monetized for downstream ransomware attacks.
Separate reporting says Bassterlord later emerged as the apparent leader of the National Hazard Agency team, extending his role beyond access sales into broader ransomware operations and training. He was reportedly linked to attacks or claimed access involving the U.S. Department of Defense-related systems, India’s Department of Revenue, the Uruguayan Navy, and private-sector victims including Maximum Industries. Analysts assess that his public retirement from ransomware was likely deceptive and that he probably remained active behind the scenes, maintaining financial and operational ties to LockBit through the National Hazard Agency.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
KELA analyzed the leaked archive and said it matched several of Bassterlord's offered accesses to entries in the dataset, including a government entity and a university access reportedly sold for USD 12,000 on July 12.
KELA says ZDNet published an exclusive report about a leak containing details from more than 900 compromised Pulse Secure VPN servers. The leak was framed as evidence of how initial access brokers support ransomware operations.
KELA reports that on August 3, 2020, uhodiransomwar released the Pulse Secure leak to expose actors allegedly reselling public compromises as exclusive private access. The publication followed a public dispute with Bassterlord on an underground forum.
On an underground forum, Bassterlord reportedly advertised access to a U.S. state-level government organization for USD 8,000, claiming the initial access came through VPN and was later leveraged into RDP.
Analyst1 says Bassterlord took first place in the 2020 Summer Paper Contest on a Russian hacking forum sponsored by LockBit. The report states this contest entry helped him gain recruitment into LockBit's affiliate program.
KELA reports that Bassterlord said he pivoted from spam-based malware activity to compromising organizations in 2019, after learning techniques for breaching targets via RDP.
According to KELA, Bassterlord said he entered cybercrime in 2016, initially running spam campaigns that delivered trojans and infostealers before later moving into organizational intrusions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LockBit grew from an early ABCD ransomware strain into one of the most prolific ransomware-as-a-service operations, combining fast multithreaded encryption, **double extortion**, and affiliate-driven intrusions against corporate victims worldwide. Researchers and incident reporting tied the group to tactics including UAC bypasses, shadow-copy deletion, log clearing, network-share encryption, and later campaigns using evasive multi-stage loaders, Safe Mode persistence, and password-protected payload delivery. The operation also recruited insiders for direct access to enterprise networks, soliciting VPN, RDP, and email credentials and offering large payouts to employees willing to run malware inside their organizations. LockBit’s criminal ecosystem evolved alongside broader ransomware market shifts, with reporting linking it to affiliate churn, code overlap with other families, and adoption of a modified Conti-based payload branded as **LockBit Green**. By 2023, analysts reported infrastructure and leak-site reliability problems that frustrated affiliates, even as the gang remained tied to major incidents such as the Royal Mail attack. In 2024, Operation Cronos disrupted LockBit infrastructure and seized decryption keys, and U.S., U.K., and Australian authorities later sanctioned and charged Russian national **Dmitry Yuryevich Khoroshev** as the alleged leader, saying LockBit hit more than 2,500 victims in at least 120 countries, collected at least **$500 million** in ransom, and caused billions in wider losses.
Aug 15, 2026
An international law enforcement operation led by the UK's National Crime Agency and the FBI seized LockBit infrastructure on 19 February 2024, disrupting one of the world's most prolific ransomware-as-a-service groups. Follow-on actions publicly identified and sanctioned a senior LockBit leader, while officials said the campaign targeted the gang's administrators, infrastructure, and criminal affiliates. Subsequent reporting said the disruption sharply reduced LockBit's standing in ransomware rankings after years in which the group had claimed thousands of victims across more than 100 countries. Threat research shows LockBit's reach was driven by a scalable affiliate model rather than malware alone, with intrusions commonly starting through abused VPN, Citrix, and RDP access or stolen credentials, followed by use of tools such as **Impacket**, **Mimikatz**, **PsExec**, **Rclone**, and **StealBit**. Affiliates increasingly targeted **VMware ESXi** environments to maximize operational impact, and some skipped encryption entirely in favor of data-theft extortion using LockBit-branded notes. The group's earlier attacks included a reported **$80 million** demand against CDW, but researchers and investigators warn that even as LockBit declines, its affiliates and copycats are likely to continue operating under other ransomware brands.
Aug 14, 2026
GuidePoint Security's GRIT reported that an entity calling itself **"Ransom Busters"** contacted ransomware victims with unsolicited offers to recover encrypted files and delete stolen data, claiming it had access to ransomware groups' infrastructure and encryption keys. Investigators assessed with moderate confidence that the operation was not a legitimate incident-recovery service but a ransomware affiliate conducting secondary extortion across multiple ransomware-as-a-service ecosystems, including intrusions linked to **DragonForce**, **Settra**, and **Anubis**. In several cases, the outreach arrived before the incidents were publicly disclosed, raising concerns that the sender had direct knowledge of the attacks. GRIT tied the activity together through overlapping tooling and infrastructure, including **SoftPerfect Network Scanner**, **s5cmd**, **Remotely**, a reused local backdoor password, and a shared attacker-controlled hostname. The actor reportedly demanded **$20,000 to $60,000** and pushed for **Bitcoin** payment while using a privacy-focused email service and early pricing demands as part of the scheme. Researchers said the campaign appears designed to divert ransom negotiations and let an affiliate monetize victims outside the normal revenue-sharing model, and they urged organizations to preserve the messages as evidence and work with incident responders and law enforcement rather than pay the actor.
Aug 20, 2026