Log in Request a demo

Malware profile

Black Basta

Black Basta is ransomware, offered to criminal affiliates as a service, that encrypts files on Windows and VMware ESXi systems and steals data to pressure victims into paying.

In short

Black Basta is ransomware, offered to criminal affiliates as a service, that encrypts files on Windows and VMware ESXi systems and steals data to pressure victims into paying. CISA and its partners say it was first identified in April 2022 and had affected over 500 organizations by May 2024.

Last updated 8 October 2026

Profile MapMalware
  1. Names2names in public reportsBlack Basta · Basta News
  2. Techniques16ATT&CK techniques listedImpact · Defense Impairment · Persistence
  3. Infection Steps6in the delivery chainInitial access · Remote access tool

In one minute

What it is
Ransomware offered as a service to affiliates, with versions for Windows and VMware ESXi, that encrypts files and steals data for double extortion.
What it does
Encrypts files with ChaCha20, deletes shadow copies, can restart the machine in safe mode, and sets the desktop wallpaper to a ransom note.
Who uses it
MITRE lists Storm-1811 as associated with deploying it. Germany's BKA, in a press release of 15 January 2026, says it suspects a Russian national of founding and leading the group, and the US Justice Department's indictment of a Qakbot leader (22 May 2025) says that actor gave access to co-conspirators who deployed Black Basta.
How it gets in
Spearphishing, known vulnerabilities such as ConnectWise CVE-2024-1709, valid credentials, and from May 2024 spam email followed by a fake tech support call or Teams message.
What to do first
Read advisory AA24-131A, patch known exploited vulnerabilities first, require phishing-resistant MFA, and allow only approved remote access tools.

What it does

MITRE says Black Basta is written in C++ and has been offered as a service since at least April 2022, with variants for Windows and VMware ESXi servers. Its operators use double extortion: they demand payment to restore files and threaten to post stolen data on a leak site if the victim does not pay.

The joint advisory AA24-131A says ransom notes do not usually state an amount or payment steps. They give a unique code and a Tor address, and typically allow 10 to 12 days before data is published. Germany’s BKA says the group was responsible for extortion from March 2022 to February 2025.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
Black BastaMITRE ATT&CK software S1070 and CISA advisory AA24-131A[1, 2]
Basta NewsName of the Black Basta Tor leak site in advisory AA24-131A[2]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Impact

  • Data Encrypted for Impact T1486

    It encrypts files with the ChaCha20 cipher using many threads at once to work faster. CISA adds that an RSA-4096 public key is used.[1, 2]

  • Inhibit System Recovery T1490

    It deletes shadow copies with vssadmin.exe so files are harder to restore.[1, 2]

  • Defacement: Internal Defacement T1491.001

    It sets the desktop wallpaper on victim machines to show a ransom note.[1]

  • System Shutdown/Reboot T1529

    It uses ShellExecuteA to shut down and restart the victim system.[1]

Defense Impairment

  • Safe Mode Boot T1688

    It can reboot a machine in safe mode with networking using bcdedit.[1]

  • Modify Registry T1112

    It changes the Registry so it can run in safe mode, to change icons and file extensions of encrypted files, and to keep its path for persistence.[1]

Persistence

  • Create or Modify System Process: Windows Service T1543.003

    It can create a new service to stay on the machine.[1]

Stealth

  • Masquerading: Masquerade Task or Service T1036.004

    It deletes the legitimate service named FAX and creates its own service with the same name.[1]

  • Virtualization/Sandbox Evasion: System Checks T1497.001

    It checks system flags, libraries, process timing and APIs to detect emulation or a sandbox.[1]

  • Debugger Evasion T1622

    The dropper checks system flags, CPU registers, process timing, libraries and APIs to tell whether a debugger is present.[1]

Execution

  • Command and Scripting Interpreter: PowerShell T1059.001

    It has used PowerShell scripts for discovery and to run files over the network. CISA also says affiliates used PowerShell to disable antivirus products.[1, 2]

  • Windows Management Instrumentation T1047

    It has used WMI to run files over the network.[1]

  • User Execution: Malicious File T1204.002

    It has been downloaded and run from malicious Excel files.[1]

Discovery

  • File and Directory Discovery T1083

    It lists specific files so it can choose what to encrypt.[1]

  • Local Storage Discovery T1680

    It can list the volumes on a machine.[1]

  • Remote System Discovery T1018

    It can use LDAP queries to connect to Active Directory and go through connected workstations.[1]

How it spreads

CISA, the FBI, HHS and MS-ISAC say affiliates primarily use spearphishing, and have also exploited known vulnerabilities and abused valid credentials. They say exploitation of ConnectWise vulnerability CVE-2024-1709 began in February 2024. In May 2024, affiliates sent victims a large volume of spam email, then called as technical support and asked them to download a remote access tool such as AnyDesk or Quick Assist. From October 2024 they also contacted victims through Microsoft Teams. MITRE adds that Black Basta has been downloaded and executed from malicious Excel files.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Initial access

    Affiliates mainly use spearphishing, and have also exploited known vulnerabilities and used valid credentials. From May 2024 they sent spam email, then called victims as fake tech support.[2]

  2. Remote access tool

    Victims were asked to download a remote access tool such as AnyDesk or Quick Assist. From October 2024 affiliates also contacted victims through Microsoft Teams.[2]

  3. Movement and privilege

    Affiliates used tools such as Mimikatz, BITSAdmin, PsExec and RDP to gain privileges and move through the network.[2]

  4. Data theft

    Affiliates used RClone to copy data out before encryption.[2]

  5. Defenses disabled

    PowerShell was used to disable antivirus products, and in some cases the Backstab tool to disable EDR tooling.[2]

  6. Encryption and note

    Files are encrypted with ChaCha20 and an RSA-4096 public key, shadow copies are deleted, and a ransom note named readme.txt is left.[2]

Timeline

  1. April 2022

    First identified

    CISA and its partners say Black Basta was first identified in April 2022. MITRE says it has been offered as a service since at least that month.[1, 2]

  2. February 2024

    ConnectWise flaw exploited

    CISA says affiliates began exploiting ConnectWise vulnerability CVE-2024-1709 in February 2024.[2]

  3. May 10, 2024

    Joint advisory AA24-131A

    CISA, the FBI, HHS and MS-ISAC released the #StopRansomware advisory on Black Basta. They said affiliates had affected over 500 organizations.[2, 3]

  4. May 2024

    Email bombing and fake support

    CISA says affiliates began sending victims large volumes of spam email, then called as technical support to get remote access.[2]

  5. October 2024

    Microsoft Teams added

    CISA says the same campaign began using Microsoft Teams to contact victims.[2]

  6. November 8, 2024

    Advisory updated

    AA24-131A was updated with new affiliate techniques and current indicators.[2]

  7. May 22, 2025

    Qakbot leader indicted

    The US Justice Department unsealed an indictment saying the defendant gave access to co-conspirators who deployed ransomware including Black Basta.[4]

  8. Late August 2025

    Ukraine search near Kharkiv

    The BKA says Ukrainian officers searched the home of a suspected member, accused of acting as a crypter to hide the malware from antivirus programs.[5]

  9. January 15, 2026

    Wanted notice and searches

    The BKA and Frankfurt prosecutors announced searches of two suspects' homes in Ukraine and a public wanted notice for the suspected leader, supported by Europol and Interpol.[5, 6]

Detection and defense

  1. Use the official advisory

    Read joint advisory AA24-131A, which lists the techniques used and carries current indicators of compromise in downloadable STIX files. Test your controls against the ATT&CK techniques in its tables.[2]

    Counters: T1486 T1490 T1566

  2. Patch known exploited vulnerabilities

    Install updates for operating systems, software and firmware as soon as they are released, and update vulnerabilities on CISA's Known Exploited Vulnerabilities list first.[2]

    Counters: T1190 T1068

  3. Require phishing-resistant MFA

    Use phishing-resistant multi-factor authentication for as many services as possible, starting with privileged administrator accounts.[2]

    Counters: T1078

  4. Train users to report phishing and fake support

    Train users to recognize and report phishing, as the joint phishing guidance recommends. This includes calls or Teams messages after a flood of spam email.[2]

    Counters: T1566 T1566.004 T1204

  5. Secure remote access software

    Apply the mitigations in CISA's Guide to Securing Remote Access Software, so tools such as AnyDesk or Quick Assist cannot be installed on a caller's request.[2]

    Counters: T1204 T1566.004

  6. Keep backups

    Back up critical systems and device configurations so they can be repaired and restored.[2]

    Counters: T1486 T1490

  7. Follow the ransomware guide

    Apply the mitigations from the joint #StopRansomware Guide, which has prevention best practices and a response checklist.[2]

    Counters: T1486

Questions

What is Black Basta?

MITRE ATT&CK describes it as ransomware written in C++, offered as a service since at least April 2022, with variants for Windows and VMware ESXi servers.

How does Black Basta get in?

CISA, the FBI, HHS and MS-ISAC say affiliates primarily use spearphishing, and have also exploited known vulnerabilities and abused valid credentials. From May 2024 they used spam email followed by fake tech support calls, and from October 2024 Microsoft Teams.

How many victims has it had?

Sources differ in scope. CISA and partners said in May 2024 that affiliates had affected over 500 organizations. Germany's BKA says that from March 2022 to February 2025 the group was responsible for extorting more than 100 organizations in Germany and about 600 others worldwide.

Who is behind Black Basta?

MITRE lists Storm-1811 as associated with deploying it. The BKA, on 15 January 2026, said a wanted notice was issued for a Russian national suspected of founding and leading the group.

What should defenders do first?

CISA recommends installing updates quickly, putting known exploited vulnerabilities first, requiring phishing-resistant MFA, training users to report phishing, securing remote access software and keeping backups.

In our research

  1. TA577 (Hive0118): The Evolving Phishing Specialist Behind Modern Malware Campaigns January 2026
  2. WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations January 2026
  3. Leaked Credentials from Ransomware Groups: Case Insights October 2025
  4. How Nation-State Cyber Threats Are Evolving – Part II August 2025
  5. Beyond WHOIS: Offshore Domains in Modern Cybercrime and Ransomware Ecosystems August 2025
  6. BlackBasta Ransomware Technical Analysis April 2025

Sources

  1. Black Basta, Software S1070 MITRE ATT&CKSupports: Description, platforms, variants, double extortion, and the techniques it uses.
  2. CISA and Partners Release Advisory on Black Basta Ransomware CISASupports: Release of the advisory on May 10, 2024.
  3. Leader of Qakbot Malware Conspiracy Indicted for Involvement in Global Ransomware Scheme US Department of JusticeSupports: Indictment of 22 May 2025 naming Black Basta among ransomware deployed by co-conspirators.
  4. Fahndung nach Kopf der Ransomware-Gruppierung Black Basta Bundeskriminalamt (BKA)Supports: Press release of 15 January 2026 on searches in Ukraine, victim counts and the wanted notice.
  5. Fahndung nach Personen, Black Basta Bundeskriminalamt (BKA)Supports: Wanted notice describing the suspected founder and leader of the group.
  6. Storm-1811, Group G1046 MITRE ATT&CKSupports: Storm-1811 associated with deployment of Black Basta ransomware.
  7. Guide to Securing Remote Access Software CISASupports: Guidance on malicious use of remote access software, detection and recommendations.

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Indrik Spider

Attributed by MITRE ATT&CK to a Russia-based criminal group, which it also lists as Evil Corp. The US Treasury, the US Department of Justice and UK authorities name people behind the Dridex banking malware and later ransomware, and have sanctioned or charged them. Its work is stealing money from banks and extorting companies with ransomware.

Read more

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more