Overview
Black Basta, which originates from Russia, is a ransomware group that operated from approximately April 2022 to February 2025. It is assessed with high confidence to be one of the offshoots of the Conti ransomware group, based on multiple pieces of evidence. This assessment is supported by the continuation of similar tactics, techniques, and procedures (TTPs), as well as the confirmed involvement of actors previously affiliated with the Conti operation based on the leak of internal chats of Black Basta that occurred in February 2025. The leak eventually resulted in the group shutting down its operations.
While the group’s primary motivation is financial gain, there is clear evidence of a strong inclination toward targeting specific nations, particularly the United States, while deliberately avoiding others. This selective targeting suggests the presence of an underlying political agenda.
| Group Alias & Alternative Names | Black Basta (Main Name), (Storm-1811 (Microsoft Threat Intelligence), UNC-4394 (Mandiant)) |
| Date of Activity | April 2022 to February 2025 |
| Threat Classification | CyberCrime |
| Motivation | Financial, Political |
| Date of Profile Publication | May 28, 2025 |
| Date of Last Update | May 28, 2025 |
| Profile Author / Analyst | Anastasia Sentsova |
| Amount of Available Information | High |
Operations & TTPs
Black Basta presents itself as a Ransomware-as-a-Service (RaaS) operation, in which the malware is rented out in exchange for a revenue-sharing model (80/20 split in favor of affiliates in case of Black Basta). While such arrangements between access brokers and Black Basta operators exist, the group primarily relies on established partnerships with botnets, such as Qakbot, DarkGate, and others, to gain initial access to victim environments.
The full Black Basta attack lifecycle and some of the tools used include:
- Initial Access
- Phishing Campaigns: Actors distribute emails containing malicious attachments or embedded links, often leading to the download of macro-enabled documents, which, when opened, execute malware on the victim’s system.
- Qakbot, DarkGate Deployment: Once the macro is enabled, malware is downloaded and executed, establishing a foothold in the victim’s network.
- Establishing Command and Control (C2)
- Qakbot and DarkGate connect to their command and control servers to download additional payloads.
- Cobalt Strike Deployment: Used for reconnaissance, lateral movement, and privilege escalation within the network.
- Lateral Movement and Privilege Escalation
- Using Mimikatz to extract credentials
- Lateral movement using protocols as tools, such as RDP and RsExec.
- Data Exfiltration
- Before encryption, sensitive data is exfiltrated using tools like Rclone or custom scripts.
- This data is later used to pressure victims into paying the ransom through the group’s data leak site.
- Ransomware Deployment
- Upon the deployment of ransomware, files are encrypted using a combination of ChaCha20 and RSA-4096 algorithms.
- The system wallpaper is changed to a ransom note, and files are encrypted, given a “.basta” extension.
For the full list of Black Basta techniques, please refer to MITRE ATT&CK, CISA Advisory, and previous reports from Unit 42 and Trend Micro.
Extortion Phase
Although the extortion and ransom demand stage is not typically included in the technical description of the attack chain, it remains a critical phase in the ransomware attack lifecycle. In the case of Black Basta, Analyst1 has developed a comprehensive understanding of the group’s extortion tactics, supported by multiple pieces of evidence, including the leak of the group’s internal chat logs in February 2025.
Black Basta’s operations incorporate double extortion tactics, in which victims are threatened with the public release of stolen data if the ransom is not paid. Additionally, the group engages in triple extortion methods, which involve harassing individuals associated with the targeted organizations, including executives, employees, and even customers, to further pressure victims into compliance.
Before starting the extortion phase, Black Basta actors gather information about their victims using tools like ZoomInfo, including their revenue, which they use to set a ransom amount. Usually, they ask for an amount equal to 1% to 3% of the company’s yearly revenue. The initial ransom is usually set high, followed by discounts offered by actors as part of the negotiation process.
The Black Basta extortion playbook includes the following tactics.
- Initial contact with the victim
- Applying pressure through threats, including a data leak threat, demonstrating knowledge of stolen data, threats of supply-chain attacks
- Escalation & Data Leak
For more information on the negotiation phase, please refer to the detailed Analyst1 report:
Exploits & Vulnerabilities
The vulnerabilities exploited by Black Basta include a wide range of systems and applications, highlighting Black Basta’s opportunistic approach in targeting both newly disclosed and older, unpatched flaws across various platforms.
Based on an investigation into the leaked Black Basta chat logs, GreyNoise identified a total of 62 CVEs referenced by the group, with 23 of them confirmed to be actively exploited by actors.
Infrastructure
Data Leak Site: stniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd.onion
Chat with Victims: bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion
Chat with Victims: aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion
DarkWeb Persona
Not available at the moment
Targets
Based on the investigation of Black Basta Data Leak Site, it was identified that, from April 19, 2022, to January 11, 2025, the United States accounted for 57% of reported victims, followed by Germany at 12%. The complete list of claimed victims includes entities from multiple countries, such as the United States, Germany, United Kingdom, Canada, Italy, Switzerland, Netherlands, Austria, France, Spain, Denmark, Belgium, Australia, Sweden, India, Brazil, Liechtenstein, Finland, Jamaica, Puerto Rico, Israel, Japan, New Zealand, Turkey, Poland, and the Czech Republic. (Source: ecrime.ch )
Targeted industries include Construction, Legal, Retail, Insurance, Real Estate, Finance, IT Services, Manufacturing, Healthcare, and others. For the period from April 19, 2022, to January 11, 2025, there were a total of 578 victims claimed.
Attribution Theory
Analyst1 assesses with a high level of confidence that Black Basta is an offshoot of the Conti ransomware group. This assessment is supported by multiple lines of evidence, including tactical and operational overlaps, such as shared infrastructure, similar TTPs (tactics, techniques, and procedures), and behavioral patterns. Notably, intelligence obtained from the leaked internal Black Basta chat logs provides strong corroboration, revealing connections to former Conti actors.