Close Menu
Technology Mag

    Subscribe to Updates

    Get the latest creative news from FooBar about art, design and business.

    What's Hot

    For Today’s Business Traveler, It’s All About Work-Life Integration

    July 3, 2025

    Phil Spencer isn’t retiring as the chief of Xbox “anytime soon”

    July 2, 2025

    Affluent Travelers Are Ditching Business Class for Business Jets

    July 2, 2025
    Facebook X (Twitter) Instagram
    Subscribe
    Technology Mag
    Facebook X (Twitter) Instagram YouTube
    • Home
    • News
    • Business
    • Games
    • Gear
    • Reviews
    • Science
    • Security
    • Trending
    • Press Release
    Technology Mag
    Home » Black Basta: The Fallen Ransomware Gang That Lives On
    Security

    Black Basta: The Fallen Ransomware Gang That Lives On

    News RoomBy News RoomApril 14, 20254 Mins Read
    Facebook Twitter Pinterest LinkedIn Reddit WhatsApp Email

    The pecking order of ransomware gangs is always shifting and evolving, with the most aggressive and reckless groups netting big payouts from vulnerable targets—but often ultimately flaming out. Russian-speaking group Black Basta is the latest example of the trend having stalled out in recent months due to takedowns by law enforcement and a damaging leak. But after some quiet weeks, researchers warn that, far from being dead and gone, the actors involved with Black Basta will reemerge in other cybercriminal groups—or potentially already have—to start the cycle once again.

    Since appearing in April 2022, Black Basta has generated hundreds of millions of dollars in payments targeting an array of corporate victims in health care, critical infrastructure, and other high-stakes industries. The group uses double extortion to pressure targets into paying a ransom—stealing data and threatening to leak it while also encrypting a target’s systems to hold them hostage. The US Cybersecurity and Infrastructure Security Agency warned last year that Black Basta had gone on a spree targeting more than 500 organizations in North America, Europe, and Australia.

    A major international law enforcement takedown in 2023 of the “Qakbot” botnet hindered Black Basta’s operations, though. And, this February, a major leak of the group’s internal data—including chat logs and operational information—rocked the group. Since then, it has gone dormant. Researchers warn, though, that the criminals behind Black Basta are already on the move and are almost certain to stage a resurgence.

    “We haven’t seen the leaders of Black Basta regroup, but they’re going to continue to work, they’re going to continue to operate,” says Allan Liska, a threat intelligence analyst focused on ransomware at the security firm Recorded Future. “There’s still too much money in it not to. And ransomware actors are creatures of habit just like anyone.”

    The leak revealed details about Black Basta’s malware and technical capabilities, its internal squabbles, and clues about the identity of the actors behind the group, particularly its main administrator. The exposed data was from what might be considered Black Basta’s heyday, September 2023 to September 2024. During this period, the group didn’t shy away from the possibility of causing harm with its breaches. A particularly aggressive attack last year on the St. Louis–based health care network Ascension, for example, reportedly caused disruptions in care, including rerouted ambulances.

    Black Basta struggled to maintain its momentum, though, after the 2023 Qakbot takedown, known as Operation Duck Hunt.

    “It was a huge blow to them, and they were trying to get back on their feet—use other botnets, work on a custom botnet, but that didn’t really work, and ultimately their infection rate was declining,” says Yelisey Bohuslavskiy, chief research officer of the threat-intelligence firm RedSense. “They had fewer targets and were getting into fewer networks. They were still dangerous, but there was this feeling that there was deterioration going on.”

    Even in this decline, there was evidence that Black Basta was trying to mount a resurgence. In addition to exploring new malware, the gang started focusing on compromising targets through social engineering and influence campaigns, particularly spam email operations and tech support scams. But after the leak, Bohuslavskiy says, members began moving to other groups and have already been buoying their new gangs.

    Like any industry, the Russian cybercriminal landscape is full of people who have worked together or competed against one another for years. Black Basta was able to establish itself so quickly because many of its members were involved with previous cybercriminal operations, including the longtime cybercriminal gang Conti. Conti is a well-known group because of another internal leak incident in 2022 that exposed its inner workings and ties to the Kremlin. After Conti’s demise, researchers tracked its members as they dispersed and started new hacking groups, including Black Basta.

    Share. Facebook Twitter Pinterest LinkedIn WhatsApp Reddit Email
    Previous ArticleCyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide
    Next Article Thistle’s Premade Vegan Meals Are Surprisingly Tasty for Being So ‘Crunchy’

    Related Posts

    Minnesota Shooting Suspect Allegedly Used Data Broker Sites to Find Targets’ Addresses

    July 2, 2025

    Telegram Purged Chinese Crypto Scam Markets—Then Watched as They Rebuilt

    June 30, 2025

    Taiwan Is Rushing to Make Its Own Drones Before It’s Too Late

    June 28, 2025

    What Satellite Images Reveal About the US Bombing of Iran’s Nuclear Sites

    June 27, 2025

    Here’s What Federal Troops Can (and Can’t) Do While Deployed in LA

    June 25, 2025

    Truth Social Crashes as Trump Live-Posts Iran Bombing

    June 25, 2025
    Our Picks

    Phil Spencer isn’t retiring as the chief of Xbox “anytime soon”

    July 2, 2025

    Affluent Travelers Are Ditching Business Class for Business Jets

    July 2, 2025

    The Next Acetaminophen Tablet You Take Could Be Made From PET

    July 2, 2025

    Google’s fix for Pixel 6A battery overheating issues arrives next week

    July 2, 2025
    • Facebook
    • Twitter
    • Pinterest
    • Instagram
    • YouTube
    • Vimeo
    Don't Miss
    News

    Racist videos made with AI are going viral on TikTok

    By News RoomJuly 2, 2025

    Racist videos that appear to be created with Google’s AI video generation tool Veo 3…

    Airplane Wi-Fi Is Now … Good?

    July 2, 2025

    Blizzard cancels all new content for its tower defense mobile game Warcraft Rumble in light of recent heavy layoffs at parent company Microsoft.

    July 2, 2025

    How Nintendo locked down the Switch 2’s USB-C port and broke third-party docking

    July 2, 2025
    Facebook X (Twitter) Instagram Pinterest
    • Privacy Policy
    • Terms of use
    • Advertise
    • Contact
    © 2025 Technology Mag. All Rights Reserved.

    Type above and press Enter to search. Press Esc to cancel.