Black Basta
Black Basta is a ransomware group with a financial motive, tracked by Brandefense. It targets 17 sectors, including Government and Technology, in 29 countries, including the United States and India. It uses 98 MITRE ATT&CK techniques and exploits 48 known CVEs.
- Black Basta Team
- Techniques
- 98
- Exploited CVEs
- 48
- First seen
- Jun 10, 2022
- Last seen
- Dec 9, 2025
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
98 techniques across 16 of 16 tacticsVulnerabilities They Exploit.
Browse Vulnerability Intelligence →100 more vulnerabilities on the Brandefense platform
Exploitation status, severity and linked malware for every CVE
Request A DemoArsenal · Malware And Tools.
- Akira ransomwaremalware
- AvNeutralizermalware
- BianLianmalware
- Bl00dy Ransomwaremalware
- Black Bastamalware
- BlackCatmalware
- BlackSuitmalware
- BrowserVenommalware
- Cobalt Strikemalware
- Contimalware
- CountLoadermalware
- CrossC2malware
- cryptomining malwaremalware
- DarkGatemalware
- DarkSidemalware
- DICELOADERmalware
- Emotetmalware
- GhostSocksmalware
- Gootloadermalware
- hivemalware
- IcedIDmalware
- Kronosmalware
- LockBit 2.0malware
- LummaStealermalware
- Medusa Ransomwaremalware
- Misticmalware
- ModeloRATmalware
- PDFSIDERmalware
- Phobosmalware
- Pikabotmalware
- Playcryptmalware
- POWERTRASHmalware
- PureHVNC RATmalware
- PureRATmalware
- QakBotmalware
- ReadNimeLoadermalware
- Royalmalware
- Side-loaded Loadermalware
- Stealcmalware
- SystemBCmalware
- TinyZBotmalware
- Vidarmalware
- VoidLinkmalware
- Adaptixtool
- AnyDesktool
- BITSAdmintool
- certutiltool
- ConnectWisetool
- Core Impacttool
- curltool
- curl.exetool
- Google Adstool
- msiexec.exetool
- MSXML2.XMLHTTPtool
- NetSupport Managertool
- NsecSoft NSecKrnltool
- PowerShelltool
- Quick Assisttool
- rundll32tool
- WinHTTP.WinHttpRequest.5.1tool
- wmictool
Campaigns.
- Black Basta Legacy Teams and Quick Assist Social EngineeringOct 2024 to Mar 2026
- Black Basta Double-Extortion Ransomware OperationsApr 2022 to Feb 2025
- QBot phishing campaignMay 2023
Indicators Of Compromise.
TLP:AMBER+STRICT- Hash
38ee04ee9d3b3912013d54483d8f822eebd0367408b369bc09f46cb339a54313 - IP
45[.]61[.]152[.]154
182 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Black Basta.
Black Basta is a financially motivated ransomware and double-extortion group that emerged in April 2022 and is widely assessed to have links to the former Conti ransomware ecosystem. CISA and partner reporting describe Black Basta affiliates compromising organizations across critical infrastructure, healthcare, and other sectors using phishing, credential access, remote monitoring and management tooling, privilege escalation, data exfiltration, and ransomware deployment.
By early 2025, public research assessed that Black Basta's core operation had slowed or collapsed following internal chat leaks and law enforcement pressure, but former affiliates and related operators continued to reuse Black Basta-style social engineering tradecraft, including email bombing, Microsoft Teams impersonation of IT support, and Windows Quick Assist abuse to gain remote access.
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.