BlackBasta

First seen
2022-02-01 00:00:00
Malware type
ransomware
Family
Malware family
Last IoC activity
2026-07-22 00:32:04
Profile updated
2026-07-07 13:43:41

Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing retail-and-hospitality technology-and-telecommunications

Context

Black Basta is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.

Detection coverage

  • 1 YARA rules

Malware & tools used

  • Qbot (infrastructure)

Used by threat actors

  • Water Curupira Pikabot Distribution (campaign)

Detection rules

  • MALPEDIA_Win_Blackbasta_Auto (yara-rule)

Related threat objects

Reports & references

  • blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
  • Kaspersky — 106950 (report)
  • advintel.io — Discontinued The End Of Conti S Brand Marks New Chapter For Cybercrime Landscape (report)
  • sentinelone.com — Crimeware Trends Ransomware Developers Turn To Intermittent Encryption To Evade Detection (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Blackbasta (report)
  • bleepingcomputer.com — American Dental Association Hit By New Black Basta Ransomware (report)
  • bleepingcomputer.com — New Black Basta Ransomware Springs Into Action With A Dozen Breaches (report)
  • Trend Micro — Examining The Black Basta Ransomwares Infection Routine (report)
  • securityintelligence.com — Black Basta Ransomware Group Besting Network (report)
  • avertium.com — In Depth Look At Black Basta Ransomware (report)
  • research.nccgroup.com — Shining The Light On Black Basta (report)
  • gbhackers.com — Black Basta Ransomware (report)
  • Trend Micro — Black Basta Ransomware Operators Expand Their Attack Arsenal Wit (report)
  • securityscorecard.com — A Deep Dive Into Black Basta Ransomware (report)
  • Palo Alto Unit 42 — Threat Assessment Black Basta Ransomware (report)
  • Trend Micro — Ransomware Spotlight Blackbasta (report)
  • sentinelone.com — Black Basta Ransomware Attacks Deploy Custom Edr Evasion Tools Tied To Fin7 Threat Actor (report)
  • cynet.com — Orion Threat Alert Qakbot Ttps Arsenal And The Black Basta Ransomware (report)
  • ransomlook.io — Blackbasta (report)
  • CISA — Aa23 131A (report)
  • sentinelone.com — Blackbasta Ransomware Group An Analysis (report)
  • Trend Micro — Blackbasta Ransomware Attacks Target Windows And Linux (report)
  • bleepingcomputer.com — Blackbasta Ransomware Linked To Conti Gang (report)

External references