Black Basta
Also known as: Black Basta ransomware
Black Basta affiliates had impacted over 500 organisations by May 2024, according to CISA. Initial access came mainly through spearphishing and known vulnerabilities. In 2024 affiliates added email bombing: flooding a user's inbox with spam, then contacting them, including over Microsoft Teams, to trick them into installing a remote access tool.
- Public attribution
- A ransomware-as-a-service operation since around April 2022 (MITRE ATT&CK); researchers assess its operators may include current or former Conti members.
- Active since
- Around 2022
- Targets
- Businesses and critical infrastructure in North America, Europe and Australia
- Healthcare
- Tracked by MITRE ATT&CK as software
- S1070 Black Basta
Status: In February 2025, internal chat logs attributed to the group were leaked publicly (reported).
Notable campaigns
2024CISA advisory and help-desk impersonation
AA24-131A, updated in November 2024, described exploitation of ConnectWise CVE-2024-1709, and social engineering that persuaded users to install remote access tools such as AnyDesk or Quick Assist.
Signature ATT&CK techniques
- T1566Phishing
- T1190Exploit Public-Facing Application
- T1059.001Command and Scripting Interpreter: PowerShell
- T1543.003Create or Modify System Process: Windows Service
- T1047Windows Management Instrumentation
- T1490Inhibit System Recovery
- T1486Data Encrypted for Impact
Selected from MITRE ATT&CK's software entry and the cited government advisory.
Defences that work against this actor
- Tell staff that IT will never cold-call and ask them to install a remote access tool; give them a way to verify.
- Restrict Quick Assist and similar tools, and limit external Teams chat to trusted domains.
- Patch remote management software such as ConnectWise ScreenConnect quickly.
- Keep offline backups and alert on shadow-copy deletion.