Cybercrime high Russia-nexus (assessed)

Black Basta

Widely assessed as an offshoot of Conti/Wizard Spider based on shared Conti v2 builder lineage, infrastructure, and payment/communication conventions — circumstantial, not a confirmed organizational chain of custody. Possible overlap with former REvil/Carbon Spider personnel. Law enforcement names an alleged leader, Oleg Evgenievich Nefedov, subject of a Europol/Interpol Red Notice. · Financial — ransomware-as-a-service, double extortion

Reports 1

Active Since No later than February 17, 2022

Last Reported 4 Sept 2026

Sectors Targeted healthcare, manufacturing, professional-services, finance, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

Spearphishing, QakBot delivery, exploitation of ConnectWise ScreenConnect (CVE-2024-1709)
Since May 2024: email-bombing followed by fake Microsoft Teams IT-support vishing, leading victims to install AnyDesk or Quick Assist
Privilege escalation via ZeroLogon, NoPac, PrintNightmare; 'Backstab' tool to disable EDR
ChaCha20 + RSA-4096 encryption, .basta extension, vssadmin shadow-copy deletion
Double extortion via RClone exfiltration and a Tor leak site, ~10–12 day deadline

Known Targets

500+ organizations across 12+ of 16 US critical infrastructure sectors (Apr 2022–May 2024)Ascension health system (widely reported, not company-confirmed)Synlab Italia, Rheinmetall, Hyundai Europe, Capita, ABBToronto Public Library, American Dental Association, Sobeys

Analyst Notes

Leak site 'Basta News' dark since January 11, 2025, after a February 2025 internal chat leak (~196,000 messages, 'ExploitWhispers') exposed infighting and fraud. ransomware.live assesses the core group likely ceased operations; 523 victims across 25 countries tallied. January 2026 Ukrainian/German police raids on two suspected members' homes. Theories that affiliates moved to CACTUS, Akira, or BlackLock rest on tradecraft overlap plus one leaked-chat reference to a Cactus payment — unconfirmed. ReliaQuest assesses with high confidence that former affiliates now run a distinct, intensifying email-bombing/Teams-vishing campaign against senior executives (77% of March–April 2026 incidents targeted senior staff) — a successor operation, not a confirmed Black Basta revival.

Also Known As

Storm-1811 (Microsoft, initial-access/vishing cluster)GOLD REBELLION (Sophos, Teams-vishing lineage)MITRE group G1046

MITRE ATT&CK Techniques

T1566 Phishing T1190 Exploit Public-Facing Application T1078 Valid Accounts T1068 Exploitation for Privilege Escalation T1562.001 Impair Defenses: Disable or Modify Tools T1486 Data Encrypted for Impact

Intelligence Reports

Analysis healthcaremanufacturing

Black Basta's Leak Site Has Been Dark Since January. Its Alumni Haven't Stopped Working

A leaked internal chat archive blew up Black Basta's operation in February 2025. The brand looks dead. The vishing playbook its affiliates built, and reportedly carried to groups like Cactus, is having a 2026 resurgence against corporate help desks.

4 Sept 2026 · 9 min read