Black Basta (ELF)
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:02:15
Targeted industries: government-and-public-sector energy-and-utilities healthcare-and-pharmaceutical manufacturing
Context
ESXi encrypting ransomware, using a combination of the stream cipher ChaCha20 and RSA.
Reports & references
- pwc.com — 2022 Year In Retrospect Report (report)
- services.google.com — M Trends 2025 En (report)
- Microsoft — Ransomware Operators Exploit Esxi Hypervisor Vulnerability For Mass Encryption (report)
- CrowdStrike — Wandering Spider (report)
- rapid7.com — Ongoing Social Engineering Campaign Linked To Black Basta Ransomware Operators (report)
- blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
- cynet.com — Orion Threat Alert Qakbot Ttps Arsenal And The Black Basta Ransomware (report)
- Trend Micro — Black Basta Cactus Ransomware Backconnect (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Blackbasta (report)
- spycloud.com — Digesting Messages From The Black Basta Chats (report)
- CISA — Aa24 131A (report)
- cyber.levelblue.com — Wp Levelblue Mdrs Guide Against Black Basta.Docx (report)
- medium.com — Black Basta Leak Analysis Add723B179A5 (report)
- trustwave.com — A Deep Dive Into The Leaked Black Basta Chat Logs (report)
- expel.com — Code Signing Certificate Abuse In The Black Basta Chat Leaks And How To Fight Back (report)
- linkedin.com — Attackers Leveraging Microsoft Teams Defaults Quick Assist P1U5C (report)
- trellix.com — Analysis Of Black Basta Ransomware Chat Leaks (report)
- stairwell.com — Stairwell Threat Report Black Basta Overview And Detection Rules (report)
- lemagit.fr — Ransomware De Revil A Black Basta Que Sait On De Tramp (report)
- flare.io — Deciphering Black Bastas Infrastructure From The Chat Le (report)
- intel471.com — Black Basta Exposed A Look At A Cybercrime Data Leak (report)
- youtube.com — Watch (report)
- esentire.com — Initial Takeaways From The Black Basta Chat Leaks (report)
- medium.com — Agent Ai Basta Parser Extraordinaire 24Edfc59992A (report)
- cloudflare.com — Black Bastas Blunder Exploiting The Gangs Leaked Chats (report)