Skip to main content
Ransomware Group

Black Basta

"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.

Known victims523

Threat level

CRITICAL

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

CredentialTheft

  • Mimikatz

DefenseEvasion

  • Backstab (Process Explorer driver)

DiscoveryEnum

  • AdFind
  • Bloodhound
  • PSNmap
  • PowerView
  • SoftPerfect NetScan

Exfiltration

  • Qaz[.]im
  • RClone

LOLBAS

  • BITSAdmin
  • PsExec
  • Quick Assist

Offsec

  • Brute Ratel C4
  • Cobalt Strike
  • Metasploit
  • PowerSploit

RMM-Tools

  • AnyDesk
  • Atera
  • NetSupport
  • ScreenConnect
  • Splashtop
  • +1 more

Known infrastructure

The following Tor hidden services have been associated with this group:

  • Chat Black Basta
  • Chat Black Basta
  • Black Basta Blog

These sites are malicious. Open them only from an isolated environment.

0

Check if you’re affected

Look up your domain to see whether it appears on Black Basta’s victim list.

Try it nowFree⌘K
Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBitALPHV BlackcatCL0PPlayBianLianAkiraMedusaRhysida