Article
BlackBasta Ransomware Technical Analysis
Learn what Black Basta ransomware is, how it works and what our technical analysis report covers: tactics, detections, IoCs and response advice.
Read more
Ransomware group profile
Black Basta ransomware group
Also known as Basta
Black Basta is a ransomware as a service operation, first identified in April 2022.
In short
Black Basta is a ransomware as a service operation, first identified in April 2022. The FBI, CISA, HHS and MS-ISAC reported in a joint advisory (AA24-131A, first published May 10, 2024) that its affiliates had hit over 500 organizations worldwide by May 2024. Ransomware as a service means the core team rents its malware to partner criminals, called affiliates, who carry out the attacks.
- Other Names1names in public reportsBasta
- Entry Routes5ways inSpearphishing · Exploit a remote access flaw · Use valid credentials
- Techniques7mapped to MITRE ATT&CKValid Accounts · OS Credential Dumping
- Defences6first steps listedUse phishing-resistant MFA · Secure remote access software
Overview
Black Basta is ransomware offered as a service. A small core team builds the malware and runs the payment and leak sites. Affiliates, who are partner criminals, break into victims and deploy it. MITRE ATT&CK describes it as ransomware written in C++ and offered under this model since at least April 2022, with versions for Windows and for VMware ESXi servers (the software that runs many virtual machines on one host).
Scale and targets
In the joint advisory AA24-131A, the FBI, CISA, the US Department of Health and Human Services (HHS) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) said Black Basta actors had encrypted and stolen data from at least 12 of the 16 US critical infrastructure sectors, including healthcare. They said affiliates had impacted a wide range of businesses in North America, Europe and Australia, and over 500 organizations worldwide as of May 2024. MITRE adds that the largest number of victims were based in the United States. The advisory explains that healthcare is attractive to criminals because of its size, its dependence on technology, its personal health information and the impact of disrupted patient care.
How affiliates get in
The advisory says affiliates mainly use spearphishing, meaning targeted phishing emails. They have also exploited known flaws, including a ConnectWise remote access flaw (CVE-2024-1709) from February 2024, and have used stolen valid logins. The November 2024 update added a social engineering method. Affiliates flooded a victim’s inbox with spam, then called or messaged posing as technical support, and asked the person to install a remote access tool. In October 2024 the same approach moved to Microsoft Teams chat from outside accounts.
What they do inside the network
Once inside, affiliates scan the network, steal passwords with Mimikatz, and move sideways using tools such as PsExec, Remote Desktop and Cobalt Strike. They copy data out with RClone, switch off security tools, delete backup snapshots and then encrypt files, adding a .basta or random extension. The advisory notes that this is typical double extortion.
- April 2022First identifiedCISA and its partners say Black Basta was first identified in April 2022.
- February 2024ConnectWise flaw exploitedAffiliates began exploiting CVE-2024-1709, per AA24-131A.
- May 2024Email bombing campaign beginsAffiliates sent victims large volumes of spam, then offered fake technical support by phone.
- May 10, 2024Joint advisory publishedThe FBI, CISA, HHS and MS-ISAC publish AA24-131A. Over 500 organizations affected by then.
- October 2024Teams used for contactAffiliates messaged victims from external Microsoft Teams accounts, posing as technical support.
- November 8, 2024Advisory updatedNew techniques and refreshed indicators of compromise added.
- Model
- Ransomware as a service
- First identified
- April 2022
- Victims
- Over 500 organizations worldwide as of May 2024
- Sectors
- At least 12 of 16 US critical infrastructure sectors
- Extortion
- Encrypt and steal data, leak site called Basta News
- Main entry routes
- Spearphishing, known flaws, valid credentials, fake support calls
Law enforcement action
The official sources opened for this page describe warnings and technical guidance. They do not describe an arrest or takedown. Check stopransomware.gov for newer government statements.
Also known as
- Basta
How they get in
-
01
Spearphishing
The advisory says affiliates primarily use spearphishing to gain access. Researchers cited by the advisory add that affiliates have also used the Qakbot malware at this stage.
-
02
Email bombing and fake support calls
From May 2024 affiliates sent victims a flood of spam, then called as IT support and asked them to install AnyDesk or Microsoft Quick Assist. In October 2024 they used Microsoft Teams messages for the same trick.
-
03
Exploit a remote access flaw
Starting in February 2024, affiliates began exploiting ConnectWise vulnerability CVE-2024-1709.
-
04
Use valid credentials
In some cases affiliates were seen abusing valid accounts, which lets them log in without any exploit.
-
05
Escalate with known Windows flaws
After entry, researchers cited by the advisory say affiliates exploited ZeroLogon (CVE-2020-1472), NoPac (CVE-2021-42278 and CVE-2021-42287) and PrintNightmare (CVE-2021-34527) to gain higher privileges.
How they extort
Double extortion, as the joint advisory describes it: affiliates encrypt systems and also steal data. The ransom note gives no price or payment steps. It gives the victim a unique code and a Tor address (a hidden site reached with the Tor browser), and typically allows 10 to 12 days to pay before the stolen data is published on the group's leak site, Basta News.
Who they target
-
01
Healthcare
See the industry page -
02
Critical infrastructure, 12 of 16 US sectors
-
03
Businesses in North America, Europe and Australia
Tools and malware
- Malware Black Basta Black Basta is ransomware, offered to criminal affiliates as a service, that encrypts files on Windows and VMware ESXi systems and steals data to pressure victims into paying. Ransomware · Since 2022 · Windows, ESXi
- Malware Cobalt Strike Cobalt Strike is a commercial remote access tool sold for adversary simulation, which means security teams use it to test their own networks. Legitimate tool abused · Since 2012 · Linux, macOS, Windows
- Malware Mimikatz Mimikatz is a tool that pulls Windows account logins and passwords out of a computer. Legitimate tool abused · Since 2007 · Windows
Techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique Exploitation for Privilege Escalation Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with. T1068 · Privilege Escalation
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Vulnerabilities they exploit
How to defend
-
Patch fast, known exploited flaws first
Install updates for operating systems, software and firmware as soon as they are released. Prioritize flaws on CISA's Known Exploited Vulnerabilities list.
-
Use phishing-resistant MFA
Require phishing-resistant multi-factor authentication for as many services as possible, starting with privileged admin accounts.
-
Train people to report phishing and fake support
Teach staff to recognize and report phishing, including unexpected IT support calls or chat messages after a burst of spam.
-
Secure remote access software
Apply the mitigations in the joint Guide to Securing Remote Access Software.
-
Back up critical systems
Make backups of critical systems and device configurations so devices can be repaired and restored.
-
Follow the #StopRansomware Guide
Apply the mitigations in the joint #StopRansomware Guide, and for healthcare, CISA's HPH Sector mitigation guide.
Questions
What is Black Basta ransomware?
Black Basta is a ransomware as a service operation first identified in April 2022. A small core team builds the malware and runs the payment and leak sites, while affiliates break into victims and deploy it. MITRE describes versions for Windows and VMware ESXi.
How does Black Basta get into networks?
Advisory AA24-131A says affiliates mainly use spearphishing. They have also exploited known flaws, including a ConnectWise flaw (CVE-2024-1709), and used stolen valid logins. A November 2024 update added email flooding followed by fake technical support calls.
How many organizations has Black Basta hit?
The FBI, CISA, HHS and MS-ISAC said affiliates had impacted over 500 organizations worldwide as of May 2024, and had hit at least 12 of the 16 US critical infrastructure sectors, including healthcare.
Has Black Basta been taken down?
The official sources opened for the page describe warnings and technical guidance, not an arrest or takedown. The page advises checking stopransomware.gov for newer government statements.
In our research
- BlackBasta Ransomware Technical Analysis April 2025
- TA577 (Hive0118): The Evolving Phishing Specialist Behind Modern Malware Campaigns January 2026
- WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations January 2026
- Leaked Credentials from Ransomware Groups: Case Insights October 2025
- How Nation-State Cyber Threats Are Evolving – Part II August 2025
- Beyond WHOIS: Offshore Domains in Modern Cybercrime and Ransomware Ecosystems August 2025
Sources
- #StopRansomware: Black Basta (AA24-131A) CISA, FBI, HHS, MS-ISAC
- Black Basta, Software S1070 MITRE ATT&CK
- Qilin, Software S1242 MITRE ATT&CK
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.