APT / THREAT GROUP

BlackBasta

aliases

Intelligence Profile

Black Basta is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.

Threat Analysis

BlackBasta is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta

→https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/

→https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/

→https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html

→https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape

→https://securityintelligence.com/posts/black-basta-ransomware-group-besting-network/

→https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware

→https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/

→https://gbhackers.com/black-basta-ransomware/

→https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

BlackBasta

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BlackBasta