extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

BlackBasta

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under BlackBasta in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

Black Basta is documented as a RaaS variant first identified in April 2022. Reporting about possible Conti personnel overlap is retained as a suspected relationship, not a confirmed succession.

Source name
BlackBasta
Canonical lineage name
Black Basta
Entity model
operation
First observed
April 2022
Last observed
Date not established
Current status
Not established

Documentary media

First page of the official StopRansomware Black Basta advisory
Joint Black Basta ransomware advisoryFirst-page preview of the FBI, CISA, HHS, and MS-ISAC joint advisory stating that Black Basta was first identified in April 2022.FBI, CISA, HHS, and MS-ISAC · published 2024-05-10 · Contextual materialEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedA low-resolution first-page excerpt is used to identify and discuss the underlying official advisory. Agency marks remain only within the unaltered document preview; no general reuse license is claimed.Source: FBI, CISA, HHS, and MS-ISAC joint advisory AA24-131A.

Known aliases

No source-supported alias is currently recorded. Malware names and actor-group names are not assumed to be equivalent.

Historical timeline

Lineage and relationships

Relationships shown from this actor's perspective
Related actor or familyRelationshipPeriodConfidenceEvidence summarySources
Contioperation Shared operatorssuspected · undirected From April 2022 Moderate confidence

MITRE records researchers' assessment that Black Basta operators could include current or former Conti members. “Could include” is not treated as confirmed membership or succession.

  • MITRE's Black Basta software entry summarizes similarities in tactics, leak sites, payment sites, and negotiations and preserves the researchers' conditional assessment.
 MITRE ATT&CK

Predecessors

None established.

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

  • Shared operators with Conti — Moderate confidence

MITRE ATT&CK integration

No explicit MITRE ATT&CK group mapping is published for this source label. Software entries and fuzzy name matches are not promoted to group mappings.

External intelligence references

  1. #StopRansomware: Black BastaFBI, CISA, HHS, and MS-ISAC · government advisory · primary authoritative
  2. Black Basta, Software S1070MITRE ATT&CK · MITRE ATTACK · authoritative secondary

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Blackbasta notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Blackbasta. Its 5 archived notes are counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter BlackBasta records

Collection: 5 records · 257 messages

BlackBasta negotiation record collection
Participants Source Archive status
20240814 50 Black Basta, Victim JSON Indexed
20230501 50 Black Basta, Victim JSON Indexed
20230410 57 Black Basta, Victim JSON Indexed
20221229 50 Black Basta, Victim JSON Indexed
20221011 50 Black Basta, Victim JSON Indexed