Black Basta

Black Basta is a financially motivated ransomware operation active since at least 2022. The group is referenced as part of the ransomware ecosystem and has been linked in reporting to initial access obtained by brokers such as Woodgnat/KongTuke, which has been publicly associated with attacks involving Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Reporting cited here states that in November 2022 Black Basta used the QakBot loader for initial access by hijacking legitimate email threads and sending phishing emails. Black Basta has also been observed exploiting or discussing vulnerabilities and remote access tooling: leaked Black Basta chat logs included active discussion of CVE-2024-3400 in Palo Alto PAN-OS, and the group has been seen exploiting Microsoft Quick Assist for initial access and persistence. CISA #StopRansomware advisories cited in the content state that Black Basta uses PsExec as a primary ransomware propagation tool. Additional reporting in the provided content describes Black Basta operational TTPs in detail, including use of EDR impairment tooling such as AvNeutralizer/AuKill, which telemetry indicated was used exclusively by the group for six months before later spreading to other ransomware actors. SentinelLABS assessed it is highly likely the Black Basta ransomware operation has ties to FIN7. Leaked Black Basta Matrix chat logs from 2025, covering September 2023 to September 2024, portray the group as a mature criminal enterprise with structured operations, two offices in Moscow, collaboration with other ransomware and malware actors, and use of ChatGPT for phishing pretexts, malware rewriting, debugging, and victim intelligence collection. Analysis of those leaks cited in the content reported potential connections to Russian authorities and identified alleged continuity with Conti-era personnel and tradecraft, including references linking leader GG/AA to Conti’s Tramp. The same reporting states Black Basta collaborated with or maintained relationships involving former Conti/Trickbot, BlackSuit/Royal, Rhysida, and Cactus-linked actors, and used or rented malware families and loaders including Pikabot, DarkGate, IcedID, and LummaC2 while developing a custom post-exploitation framework called Breaker. The content also notes Black Basta’s use of Linux/ESXi-focused ransomware is discussed alongside other major ransomware groups, although one cited report found no obvious similarity between Black Basta’s ESXi lockers and Babuk-derived families. Known alias mentioned in the content: Storm-1811.