Black Basta — Ransomware Profile
Black Basta emerged in 2022 as a high-impact ransomware group believed to include former Conti members, targeting critical sectors globally.Also tracked as
UNC4393, BASTA
IntelFusions coverage (2)
- NightSpire: The Rbfs Rebrand That Went From Data Theft to Double Extortion in Weeks 2026-02-16 · Ransomware
- Reynolds Ransomware Bundles BYOVD Defense Evasion Directly Into Payload — A Rare and Dangerous Evolution 2026-02-05 · Ransomware
Tools & malware
- BackConnect (QBACKCONNECT) persistence/remote-access malware
- Black Basta (BASTA) ransomware encryptor ransomware
- Brute Ratel C4 post-exploitation C2 framework
- Cobalt Strike BEACON post-exploitation C2 framework
- COGSCAN .NET reconnaissance/host-enumeration tool
- DAWNCRY memory-only dropper
- KNOTROCK .NET ransomware deployment utility
- KNOTWRAP memory-only dropper
- PORTYARD custom TCP tunneler
- QakBot loader/banking trojan (initial access)
- SILENTNIGHT backdoor (initial access)
- SYSTEMBC tunneler/proxy
Recent claimed victims
- Granby Industries 2025-01-11
- bnext.nl 2025-01-11
- Mortgage Investors Group (MIG) 2025-01-11
- Avril Supermarché Santé 2025-01-11
- Brachot 2025-01-11
- Schuff Steel Company 2025-01-11
- Plasma-Therm 2025-01-11
- Arun Estates 2025-01-11
- Medion AG 2024-12-18
- Bender GmbH & Co. KG 2024-12-18
- Fruit of the Earth 2024-12-18
- Active Dynamics 2024-12-18
- Wikov 2024-12-18
- Valveworks USA 2024-12-18
- Bath Fitter 2024-12-18
- Furmano's 2024-12-18
- Grimaldi Alliance 2024-12-18
- interspiro.com 2024-12-11
- Lorne Stewart Group 2024-12-04
- Westbank Corp 2024-12-04
- Vossko GmbH & Co. KG 2024-12-04
- snatt.it 2024-12-04
- btci.com 2024-12-04
- Medica Corporation 2024-12-04
- g-s.co.uk 2024-12-04
Vendor research
- #StopRansomware: Black Basta (AA24-131A) CISA / FBI / HHS / MS-ISAC
- UNC4393 Goes Gently into the SILENTNIGHT Google Cloud (Mandiant)
- Threat actors misusing Quick Assist in social engineering attacks leading to ransomware Microsoft Threat Intelligence
- Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike Trend Micro
- Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal Trend Micro