Black Basta

Description

Black Basta is a ransomware operation that emerged in April 2022, founded by cyberattackers with ties to the dismantled Conti network. Its affiliates gain access through phishing, exposed remote services, and stolen credentials, exfiltrate data before encryption, and extort victims through a leak site. The operation has hit hundreds of organizations worldwide across healthcare, manufacturing, finance, and other sectors, and it continues to update its Windows and Linux encryptors.

Stats

First seen: June 2022
Last seen: October 2026

Also known as

BlackBASTABlackBastaBlackbasta

MITRE ATT&CK techniques

26 techniques across 6 tactics.

TA0002 Execution

T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.001PowerShell
T1106Native API
T1204User Execution
- T1204.002Malicious File

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.001Binary Padding
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
- T1036.004Masquerade Task or Service
T1480Execution Guardrails
- T1480.002Mutual Exclusion
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1622Debugger Evasion

TA0007 Discovery

T1007System Service Discovery
T1018Remote System Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1680Local Storage Discovery

TA0040 Impact

T1486Data Encrypted for Impact
T1490Inhibit System Recovery
T1491Defacement
- T1491.001Internal Defacement
T1529System Shutdown/Reboot

TA0112 Defense Impairment

T1112Modify Registry
T1222File and Directory Permissions Modification
- T1222.002Linux and Mac Permissions
T1553Subvert Trust Controls
- T1553.002Code Signing
T1688Safe Mode Boot

Associated groups

G1046Storm-1811

Alert name variants

Alert Name	Engine
Document-PDF.Trojan.BlackBasta	ATP Sandbox Adv. Heuristics
DOS.Ransomware.BlackBasta	ATP Sandbox Adv. Heuristics
Gen:Variant.Ransom.BlackBasta.14	AV
Gen:Variant.Ransom.BlackBasta.22	AV
Gen:Variant.Ransom.BlackBasta.29	AV
Gen:Variant.Ransom.BlackBasta.30	AV
Gen:Variant.Ransom.BlackBasta.44	AV
Gen:Variant.Ransom.BlackBasta.51	AV
Gen:Variant.Ransom.BlackBasta.53	AV
Gen:Variant.Ransom.BlackBasta.6	AV
Linux.Ransomware.BlackBasta	ATP Sandbox Adv. Heuristics
Trojan.Ransom.BlackBasta.A	AV
Win32.Ransomware.Blackbasta	ATP Sandbox Adv. Heuristics
Win32.Ransomware.BlackBasta	ATP Sandbox Adv. Heuristics
Win32.Ransomware.BlackBASTA	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Blackbasta	ATP Sandbox Adv. Heuristics
Win64.Ransomware.BlackBasta	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Trojan.BlackBasta variant outbound communication attempt	IPS-SWG
MALWARE-OTHER Win.Trojan.BlackBasta variant download attempt	IPS-SWG

Related blogs

Latrodectus Rapid Evolution Continues With Latest New Payload Features

August 29, 20246 min read