Threat intelligence / Malware

Black Basta

[Black Basta](https://attack.mitre.org/software/S1070) is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. [Black Basta](https://attack.mitre.org/software/S1070) operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. [Black Basta](https://attack.mitre.org/software/S1070) affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the [Black Basta](https://attack.mitre.org/software/S1070) RaaS operators could include current or former members of the [Conti](https://attack.mitre.org/software/S0575) group.(Citation: Palo Alto Networks Black Basta August 2022)(Citation: Deep Instinct Black Basta August 2022)(Citation: Minerva Labs Black Basta May 2022)(Citation: Avertium Black Basta June 2022)(Citation: NCC Group Black Basta June 2022)(Citation: Cyble Black Basta May 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Black Basta](https://attack.mitre.org/software/S1070) is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. [Black Basta](https://attack.mitre.org/software/S1070) operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. [Black Basta](https://attack.mitre.org/software/S1070) affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the [Black Basta](https://attack.mitre.org/software/S1070) RaaS operators could include current or former members of the [Conti](https://attack.mitre.org/software/S0575) group.(Citation: Palo Alto Networks Black Basta August 2022)(Citation: Deep Instinct Black Basta August 2022)(Citation: Minerva Labs Black Basta May 2022)(Citation: Avertium Black Basta June 2022)(Citation: NCC Group Black Basta June 2022)(Citation: Cyble Black Basta May 2022)

Labels

malware

27 recorded

Relationships

uses

to Binary Padding

Technique

uses

to Code Signing

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Debugger Evasion

Technique

uses

to File and Directory Discovery

Technique

uses

to Inhibit System Recovery

Technique

uses

to Internal Defacement

Technique

uses

to Linux and Mac Permissions

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Mutual Exclusion

Technique

uses

Technique

uses

Technique

uses

to Remote System Discovery

Technique

uses

to Safe Mode Boot

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Service Discovery

Technique

uses

to System Shutdown/Reboot

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

uses

from Storm-1811

Group

7 external

References

mitre-attack

S1070

Avertium Black Basta June 2022

https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware

Cyble Black Basta May 2022

https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/

Palo Alto Networks Black Basta August 2022

https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware

NCC Group Black Basta June 2022

https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/

Deep Instinct Black Basta August 2022

https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence

Minerva Labs Black Basta May 2022

https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/