Executive Summary
For most of 2024, Black Basta was one of the most active ransomware operations tracked by CISA, responsible for breaches at more than 500 organizations across at least 12 of the 16 US critical infrastructure sectors between April 2022 and May 2024, including the widely reported Ascension health system incident. Then, in February 2025, an internal chat archive — roughly 196,000 messages, leaked under the handle “ExploitWhispers” — spilled into public view and exposed infighting, fraud among members, and operational details the group had kept private. Its leak site, “Basta News,” posted its last known victim on January 11, 2025, and has shown no activity since. Multiple trackers and researchers now assess the core group as likely defunct. That is not the end of the story: ReliaQuest reports with high confidence that former Black Basta affiliates are running a distinct, highly active help-desk impersonation and vishing campaign against senior executives that intensified sharply in early 2026 — a continuation of tradecraft, even if the Black Basta brand itself never comes back.
Who Black Basta Was
Black Basta material first appeared no later than February 17, 2022 — notably before the February 27, 2022 leak of the Conti ransomware group’s internal chats and source code, which undercuts the simplest version of the “Black Basta is just Conti renamed” theory. The relationship researchers settled on instead is an offshoot: Black Basta is widely assessed to have emerged from Conti/Wizard Spider’s orbit, based on shared lineage with the Conti v2 encryptor builder, overlapping infrastructure, and similar payment and victim-communication conventions — circumstantial but consistent evidence, not a confirmed organizational chain of custody. Some analysts have also floated overlap with former REvil/Carbon Spider personnel. Law enforcement names a specific alleged leader: Oleg Evgenievich Nefedov, the subject of a Europol/Interpol Red Notice. Vendor tracking names split by activity cluster rather than by a single unified identity — Microsoft tracks the initial-access and vishing cluster as Storm-1811, MITRE assigns the group ID G1046, and Sophos refers to the Teams-vishing lineage as GOLD REBELLION. Operationally, Black Basta ran as ransomware-as-a-service, with affiliates splitting profits with the core development team.
How Intrusions Worked
CISA’s advisory AA24-131A (last updated November 2024) describes a group that leaned on spearphishing, QakBot delivery, and exploitation of ConnectWise ScreenConnect (CVE-2024-1709), alongside valid or stolen credentials. Starting in May 2024, the group pioneered a social-engineering pattern that has since outlived it: flood a target’s inbox with spam (“email bombing”), then have an actor impersonate IT support over Microsoft Teams, walking the frustrated employee into installing a remote-access tool — AnyDesk or Quick Assist — that gives the attacker hands-on-keyboard access. From there, the documented toolkit is extensive: BITSAdmin, Cobalt Strike, Mimikatz, PsExec, PowerShell, RClone, SoftPerfect NetScan, ScreenConnect, Splashtop, and WinSCP, with privilege escalation via ZeroLogon, NoPac, or PrintNightmare, and a custom tool called “Backstab” used specifically to disable endpoint detection software. Encryption used ChaCha20 with RSA-4096 key wrapping, appending a .basta extension and dropping a readme.txt ransom note, with shadow-copy deletion via vssadmin to block easy recovery. Exfiltration ran through RClone ahead of encryption, backing double extortion via a Tor leak site and a roughly 10–12 day payment deadline.
The Collapse
The February 2025 chat leak did more damage to the group’s internal cohesion than any single law enforcement action had up to that point — exposing fraud among affiliates and management disputes that are harder to recover from than infrastructure seizure, since trust among criminal partners doesn’t rebuild the way a Tor hidden service does. PRODAFT and ransomware.live both assess the core group as likely having ceased operations in early 2025; ransomware.live’s tally (checked in this reporting cycle) puts total victims at 523 across 25 countries, with the United States alone accounting for 187. In January 2026, Ukrainian and German police conducted raids on the homes of two suspected members — a law enforcement action, not an indictment or confirmed arrest in the record reviewed for this piece, worth noting precisely because “raided” and “arrested and charged” are different things.
Where did the people go? This is the part of the story with the least solid grounding, and it should be treated that way. ReliaQuest has floated former Black Basta affiliates migrating to CACTUS (also tracked as Nurturing Mantis) or to Akira, based on tradecraft and infrastructure overlap, and flagged BlackLock as a further possibility. The strongest single piece of evidence tying Black Basta affiliates to Cactus specifically is one line in the leaked chat archive referencing a ransom payment of roughly $500,000–$600,000 attributed to Cactus — suggestive of a financial relationship, not proof of a migrated workforce. It’s also worth noting that Cactus’s own leak site has shown no new victims since March 2025, per ReliaQuest — which complicates the idea that Cactus absorbed a wave of displaced Black Basta talent and kept operating at pace. Treat every “where they went” claim in this space as a working theory, not a settled fact.
The 2026 Resurgence — of Tradecraft, Not the Brand
What is better supported is a change in volume and targeting of the vishing playbook itself. ReliaQuest’s April 2026 reporting assesses with high confidence that former Black Basta affiliates are running a unified campaign combining email bombing, fake Microsoft Teams IT-support calls, and AnyDesk or Quick Assist deployment — the same mechanics Black Basta pioneered in 2024 — now aimed disproportionately at senior executives. In March–April 2026, 77% of tracked incidents targeted senior staff, up from 59% in January–February 2026. More strikingly, 56% of all Teams-phishing activity ReliaQuest has tracked since the group’s 2025 decline occurred in just the January–April 2026 window — a concentration that reads as a deliberate scale-up by whoever inherited the technique, not noise. This is best understood as a successor social-engineering and initial-access operation carried forward by people who learned the trade inside Black Basta, not a confirmed revival of Black Basta-branded ransomware deployment. No reporting reviewed here ties this 2026 vishing surge back to a specific encryptor or leak-site brand.
What This Means
For defenders, the actionable takeaway sits with the technique, not the group name. Email-bombing-plus-fake-IT-vishing-via-Teams is a pattern that survived its originating brand’s collapse and, per ReliaQuest’s data, is currently more active than at any point since early 2025. Help desk verification procedures, Teams external-contact restrictions, and user training specifically covering “IT will never ask you to install remote access software over a call you didn’t initiate” are more relevant controls right now than anything keyed to the Black Basta name itself. Whether the original Black Basta operation ever formally returns — as itself, as a rebrand, or not at all — is open; the technique it popularized clearly didn’t go anywhere.