Black BastaMalware
Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers.From MITRE ATT&CK
Last reported 23 days ago, by Zscaler ThreatLabz11 reports
ATT&CK techniques
6 of 46 · each with the sentence it comes from- T1053.005Scheduled Task
“In the following image, there can be seen two procedures: the first guides the threat actors to create a scheduled task to execute the ransomware in the Netlogon folder by using Windows cmd; whereas the second guides the threat actors to place the ransomware in the Netlogon folde…”
- T1684Social Engineering
“…edibility, creating downstream opportunities for attackers to extend their reach.Generative AI is also making target selection and social engineering sharper.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1036Masquerading
“Code Masquerading”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter (T1059)”
- T1550.002Pass the Hash
“The credentials can be usernames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
From Access to Exfiltration: What Defenders Need to Know“…bz observed likely AI-assisted tooling in a campaign by Payouts King, a group that emerged in mid-2025 with tradecraft tied to former Black Basta affiliates, in which multiple functional iterations of a malicious batch script appeared to have been generated programmatically.”
-
From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO“International disruption operations targeted several ransomware ecosystems, but as RansomHub went offline in April 2025 and Black Basta became largely inactive following internal chat leaks and operational disputes, displaced affiliates migrated between operators and adopted dist…”
-
PikaBot: a Guide to its Deep Secrets and Operations“Successful PikaBot compromises have reportedly led to Black Basta ransomware deployment, making it a serious threat.”
-
Fake Tech Support Delivers Havoc Command & Control“documented similar campaigns with links to Black Basta and FIN7 in January of 2025.”
-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“Part of the analyzed activity in the ShadowSyndicate cluster can be attributed to Cl0p, ALPHV/BlackCat, Black Basta, Ryuk, and Malsmoke.”
-
Time to Ransom is Money“At the other end of the spectrum, Conti, Play, and Black Basta carried out fewer than 10 actions, on average.”
-
Ransomware debris: an analysis of the RansomHub operation“… have already happened, including the arrest of individuals tied to Phobos ransomware, 8Base and Affiliate 2803 groups, data leaks of Black Basta‘s Matrix server and Medialand bullet proof server as well as the downtime of RansomHub infrastructure.”
-
Fast, smart, and private: Group-IB introduces AI Assistant“A CISO might come across a mention of a new threat actor targeting their industry — say Black Basta — but have no background information and need more intel fast.”
-
The beginning of the end: the story of Hunters International“Taking into account the uncertainty and fear caused by ALPHV, NoEscape and Black Basta exit scams, some criminals may think it is safer to store the data exfiltrated from the victims in their own infrastructure.”
-
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs“GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“IcedID was detected in attacks involving the following ransomware groups: Karakurt, RansomEXX, Black Basta, Nokoyawa, Quantum, REvil, Xingteam, and Conti.”
Thanks — we review every report.