What is Black Basta ransomware?

Black Basta is a ransomware-as-a-service operation first seen in April 2022. In joint advisory AA24-131A, first published on 10 May 2024, CISA, the FBI and partner agencies reported that its affiliates had affected over 500 organisations worldwide, including 12 of the 16 US critical infrastructure sectors, using double extortion: encrypting systems and stealing data. Initial access typically came through spear phishing and the exploitation of known vulnerabilities; the advisory also describes affiliates using legitimate remote-access and file-transfer tools, stolen credentials and remote desktop to move between machines. Researchers widely reported that the group's internal chat logs leaked in February 2025, after which its activity declined. The advisory's recommendations make a useful baseline for any company: keep systems patched, require phishing-resistant MFA, train staff to recognise phishing, keep offline backups, and control which remote-access software is allowed.

← All 25 questions on Ransomware groups and familiesAll topics