Lessons from the BlackBasta Ransomware Attack on Capita

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

A look at ‘Tinker,’ Black Basta’s phishing fixer, negotiator

The leader of the Black Basta ransomware group employed a trusted, experienced cybercrime actor nicknamed Tinker who he relied on for phishing content,…

BlackSuit Continues Social Engineering Attacks in Wake of Black Basta’s Internal Conflict | Rapid7 Blog

Despite a significant decrease in social engineering attacks linked to the Black Basta ransomware group since late December 2024, Rapid7 has observed sustained social engineering attacks. Evidence suggests that BlackSuit affiliates have either adopted Black Basta’s strategy or absorbed its members.

Inside BRUTED: Black Basta (RaaS) Members Used Automated Brute Forcing Framework to Target Edge Network Devices

Arda Buyukkaya reveals how the Black Basta Ransomware-as-a-Service (RaaS) group used an automated brute forcing framework to target edge network devices of its victims.

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

BlackBasta Leaks: Lessons from the Ascension Health attack

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs

Ransomware group Black Basta’s chat logs were leaked, revealing 62 mentioned CVEs. GreyNoise identified 23 of these CVEs as actively exploited, with some targeted in the last 24 hours.

Black Basta ransomware gang's internal chat logs leak online

An unknown leaker has released what they claim to be an archive of internal Matrix chat logs belonging to the Black Basta ransomware operation.

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware | Rapid7 Blog

Beginning in early October, Rapid7 has observed a resurgence of activity related to the ongoing social engineering campaign being conducted by Black Basta ransomware operators.