APT / THREAT GROUP

BlackBasta

aliases

Intelligence Profile

Black Basta is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.

Threat Analysis

BlackBasta is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Ransomware Victims (558)

CTIWATCH tracks 558 organizations claimed as victims by BlackBasta on its data leak site, with attack dates, sectors and countries.

View full victims list →

External References

→https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta

→https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/

→https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/

→https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html

→https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape

→https://securityintelligence.com/posts/black-basta-ransomware-group-besting-network/

→https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware

→https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/

→https://gbhackers.com/black-basta-ransomware/

→https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

BlackBasta

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·BlackBasta Victims (558)·Geopolitics Map·Search BlackBasta