BlackBasta — 20230410

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date 17:14

   Hello, we were told to come here

2. Message 002 From Black Basta Actor / other Date 07:51

   Hello. Who are you in this company? What is your position?

3. Message 003 From Victim Victim Date 12:25

   Im an admin. I was assigned to communicate with you.

4. Message 004 From Black Basta Actor / other Date 13:38

   Do you need a private chat?

5. Message 005 From Victim Victim Date 15:51

   This is a private chat. Only I have access to this

6. Message 006 From Black Basta Actor / other Date 15:54

   We are Black Basta Group. We are here to inform that your company local network has been hacked and encrypted. We've downloaded over 110GB of a sensitive information and data from your network. Check your page in our blog. Right now we're keeping it secret. However, if we don't come to an agreement within 10 days, it'll be posted on our news board. We will let everyone who wants to connect to your network and get all the necessary data from your. Decryption price is $400,000. In case of successful negotiations we guarantee you will get:

   1) Decryptor for all your Windows machines; 2) Non recoverable removal of all downloaded data from our side; 3) Security report on how you were hacked to fix your vulnerabilities and avoid such situations in future.

   Hope you can correctly assess the risks for your company. You can find more information about Black Basta Group in Google.

7. Message 007 From Victim Victim Date 18:36

   Thank you for this information. I will be in touch

8. Message 008 From Black Basta Actor / other Date 19:17

   okay

9. Message 009 From Victim Victim Date 14:58

   you have 110GB of our data? what data is it?

10. Message 010 From Black Basta Actor / other Date 15:49

    Wait please, we'll send you the list of your taken data.

11. Message 011 From Black Basta Actor / other Date 16:01

    Download file: [redacted].rar

12. Message 012 From Black Basta Actor / other Date 16:02

    You can choose any 5 file names from this list and we will send them to you, like a proof.

13. Message 013 From Victim Victim Date 14:04

    ok thank you we will take a look

14. Message 014 From Black Basta Actor / other Date 14:05

    okay

15. Message 015 From Victim Victim Date 15:00

    does this list represent all of the data you took?

16. Message 016 From Black Basta Actor / other Date 15:08

    Yes, this is full list.

17. Message 017 From Victim Victim Date 14:14

    Here are the files that leadership has requested: Paperless\EMAILS 2020-2022\Congratulations [redacted].msg Vol4\CL\[redacted]Files\[redacted] - Notice of Substitution.docx Vol4\CL\[redacted]\[redacted] Plaintiff Expert Materials\[redacted]\Floormat recall.pdf Vol4\CL\7777\031\[redacted]\[redacted]\footballpressboxlist.pdf Vol4\USER\[redacted]\XMAS\Christmas 2004\Holiday Name Tags Template2.doc

18. Message 018 From Black Basta Actor / other Date 14:15

    Wait please.

19. Message 019 From Black Basta Actor / other Date 14:27

    Download file: [redacted].rar

20. Message 020 From Black Basta Actor / other Date 14:27

    These are requested files.

21. Message 021 From Victim Victim Date 13:41

    Ok. We are having internet issues. Everyone is working from different locations. I will give these to leadership to review. No one will be back until Monday. I will write you then

22. Message 022 From Black Basta Actor / other Date 13:43

    Understood. Wait you on Monday.

23. Message 023 From Victim Victim Date 13:18

    How do we know that your decryptor will work for our systems?

24. Message 024 From Black Basta Actor / other Date 14:14

    You can send some encrypted files, we decrypt them and send back to you. But these files must be unimportant.

25. Message 025 From Victim Victim Date 16:37

    Ok, I will have leadership choose some files.

26. Message 026 From Black Basta Actor / other Date 16:53

    okay

27. Message 027 From Victim Victim Date 14:17

    Download file: [redacted].jpg

28. Message 028 From Victim Victim Date 14:17

    Download file: [redacted].doc

29. Message 029 From Victim Victim Date 14:18

    Here are two files that leadership chose.

30. Message 030 From Black Basta Actor / other Date 14:21

    Wait please.

31. Message 031 From Black Basta Actor / other Date 14:31

    Download file: [redacted].jpg

32. Message 032 From Black Basta Actor / other Date 14:31

    Download file: [redacted].doc

33. Message 033 From Victim Victim Date 14:55

    Ok, I will show these to leadership and will be back in touch with you

34. Message 034 From Black Basta Actor / other Date 14:56

    We'll in touch.

35. Message 035 From Victim Victim Date 13:46

    My leadership has a meeting scheduled with the board on Monday afternoon. Before that meeting, is there any cost breaks that you could provide us? This event has had a significant impact on our company.

36. Message 036 From Black Basta Actor / other Date 15:09

    10% discount for you and we close the deal.

37. Message 037 From Victim Victim Date 13:53

    Ok, I will provide this to my leaders and I will be back in touch on Monday afternoon.

38. Message 038 From Black Basta Actor / other Date 15:39

    Okay, we'll be in touch.

39. Message 039 From Victim Victim Date 20:33

    Our leadership wants this to come to an end for both of us so we can get back to normality. They would like to offer $39,250 with all fees included. This would include the decryptor with any assistance we may need with it, proof that all our data has been removed from your systems and deleted with the promise not to ask for any additional money for anything after payment is received, a detailed explanation on how you got into our systems, and the promise to never attack us again. Please accept this offer so we can move on.

40. Message 040 From Black Basta Actor / other Date 20:36

    Are you seriously? This is an unacceptable offer. We will not even turn our heads in your direction for such a meager amount. Increase it.

41. Message 041 From Black Basta Actor / other Date 16:36

    We also want to remind you that you have a lot of critical data, a lot of personal data of your employees and customers, copies of passports and driver's license ([redacted] and many others), their SSN, DOB, addresses and phone numbers, your NDA, confidential agreements, financial documents and other documents can be used for bad purposes, loans, etc. Darknet users know how to do this. Therefore, we suggest you to think better and make the worthy offer.

42. Message 042 From Victim Victim Date 17:18

    What is meager to you, is not to us. Since this event we are struggling to get operational and have experienced tremendous losses. Leadership is prepared to offer $44,990 with all fees included. This would include the decryptor with any assistance we may need with it, proof that all our data has been removed from your systems and deleted with the promise not to ask for any additional money for anything after payment is received, a detailed explanation on how you got into our systems, and the promise to never attack us again. Please consider this offer as we are trying to get our business back operational.

43. Message 043 From Black Basta Actor / other Date 17:43

    We are ready to help restore all your systems and files to their original state very quickly, but the minimum amount we can accept is $150k. Less payment is not possible. Therefore, tell your manager if he wants to make a deal, then he look for this amount. If not, then further negotiations are pointless.

44. Message 044 From Victim Victim Date 13:27

    Leadership is prepared to accept your offer of $150,000 with all fees included. This would include a working decryptor with any assistance we may need with it, proof and assurance that all our data has been removed from your systems, deleted, not copied or transferred elsewhere, and with the promise not to ask for any additional money for anything after payment is received, a detailed explanation of why we were targeted and how you got into our systems, and the promise to never attack us again. Please send us your bitcoin wallet ID so we can proceed with payment.

45. Message 045 From Black Basta Actor / other Date 14:06

    Okay. We confirm all points. Our BTC wallet is [redacted]

46. Message 046 From Victim Victim Date 18:49

    Ok. This may take some time, but please confirm when you receive payment. I will write you when it is sent.

47. Message 047 From Black Basta Actor / other Date 19:04

    Okay.

48. Message 048 From Black Basta Actor / other Date 16:58

    Any updates?

49. Message 049 From Victim Victim Date 18:51

    payment was made. Can you confirm please

50. Message 050 From Black Basta Actor / other Date 18:54

    Yes, we see the transaction, but it hasn't been confirmed yet. Please wait.

51. Message 051 From Black Basta Actor / other Date 19:06

    Payment received.

52. Message 052 From Black Basta Actor / other Date 19:06

    Your data is wiping.

53. Message 053 From Victim Victim Date 19:07

    Thank you. I will stand by for all the agreed upon deliverables.

54. Message 054 From Black Basta Actor / other Date 19:40

    This is log of deletion ALL your taken data Download: https://qaz.im/load/[redacted] Delete: https://qaz.im/index.php?a=delete&q=[redacted]

55. Message 055 From Black Basta Actor / other Date 23:44

    Download file: [redacted].ex

56. Message 056 From Black Basta Actor / other Date 23:44

    How to decrypt windows? 1. Drop executable to any folder. 2. Start new terminal session with administrator rights. (run cmd.exe or powershell.exe with admin rights) 3.1. In cmd.exe type full path to the executable file and press Enter. 3.2. In powershell.exe type: "& c:\full\path\to\executable.exe" without quotes and press Enter.

    OR

    1. Drop file. 2. Click right mouse button on the file and press run as admin.

    (!) IMPORTANT, READ ALL BEFORE DECRYPTION PROCESS 1. Yoy can decrypt only 1 folder (test decrypt for example) decrypt.exe -forcepath c:\users\1\Desktop\folder 2. DO NOT CLOSE decryptor yourself 3. MAKE BACKUPS of important files what you will decrypt, then you can rerun decryptor if something happens 4. You can decrypt partially encrypted files: 4.1. Make backup 4.2. Add encrypted extension (random for every company, you can ask in chat) to file 4.3. Run decryptor to folder what contains file 4.4. Now you can test file 5. Every decryption process saves file in same location with name of decrypted file with extension.kbckp. In this file you can find individual chacha keys for better recovery experience. 6. You can ask in chat about ECC keys (used to encrypt chacha keys) for your company. 7. Make sure you have at least 10 gb of free space on each disk. 8. To choose folder on linux decrypt.linux -forcepath /path

57. Message 057 From Black Basta Actor / other Date 03:02

    Security report and recommendation: Your network has been compromised by mailing of messages to the emails with malicious attachments. One of the users launched malware. To avoid this in the future, give you recommendations of network protection: 1. Use sandbox to analyze the contents of letters and their attachments. 2. Use the password security policies 3. Make protection from attack like a Pass-the-Hash and Pass-the-ticket attack 4. Update all OS and software to the latest versions, especially Microsoft Defender Antivirus. 5. Implement the hardware firewalls with filtering policies, modern DLP and IDS, SIEM systems. 6. Block kerberoasting attacks 7. Conduct full penetrations tests and audit 8. Use and update Anti-virus/anti-malware and malicious traffic detection software 9. Configure group policies, disable the default administrators accounts, create new accounts. 10. Backups. You must have offline backups, does not have access to the network.