Black Basta
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 27 incidents
- Sources
- 28 sources
- First seen
- 2022-04-20
- Last seen
- 2024-12-11
- Updated
- 2026-10-16 13:19
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Black Basta is a ransomware gang that emerged in early 2022 and is publicly linked to the Conti ransomware group, with investigators noting Russian‑language ties and alleged connections to the Russian government. The group operates as a ransomware‑as‑a‑service, deploying its own encryptor (described as using ChaCha20 and RSA‑4096) and maintaining darknet leak sites for double‑extortion tactics. Initial access is frequently gained through Qbot/QakBot malware, after which the ransomware encrypts Windows and Linux systems, including VMware ESXi virtual machines. Black Basta has targeted a wide range of sectors worldwide, including financial institutions (mortgage lenders and banks), telecommunications providers, healthcare organizations, water and energy utilities, mining companies, retailers, construction firms, and aviation businesses, seeking financial gain through ransom payments and the threat of publishing stolen data. Notable publicly reported incidents involve a British telecom’s conferencing platform, a U.S. mortgage lender, Veolia North America’s water division, Alamos Gold’s mining operations, and the industrial firm ABB, among others.
Incidents
Attributed incidents are available to members.
27 incidentsSources
Sources available to members: 28 sources.