Research page reference

Archived note files

5 supported · 0 skipped
Blackbasta ransomware note files
Original filenameFile typeContent hashSourceInternal archive
blackbasta1.txt Plain text (.txt) eccc82bda8dfb574… Upstream file Read archived source
blackbasta2.txt Plain text (.txt) 65a7023e795a4ead… Upstream file Read archived source
blackbasta3.txt Plain text (.txt) 817a37999506205f… Upstream file Read archived source
blackbasta4.txt Plain text (.txt) 49d3db3e149dbdda… Upstream file Read archived source
instructions_read_me.txt Plain text (.txt) 40dd8605cdc19678… Upstream file Read archived source

Negotiation records

Threat actor page: BlackBasta

An explicit archive alias maps the ThreatLabz family Blackbasta to the Ransomchats actor label BlackBasta. Note and negotiation counts remain separate.

Negotiation records explicitly mapped to Blackbasta
Participants Source Archive status
20240814 50 Black Basta, Victim JSON Indexed
20230501 50 Black Basta, Victim JSON Indexed
20230410 57 Black Basta, Victim JSON Indexed
20221229 50 Black Basta, Victim JSON Indexed
20221011 50 Black Basta, Victim JSON Indexed

Dataset provenance and citation

Stable family archive information
Upstream collectorZscaler ThreatLabz
Source repositoryThreatLabz/ransomware_notes
Source directoryblackbasta
Snapshot commit2bbf5b4ecda84837c4a71af1a99c6821920f051a
Dataset snapshotJun 26, 2026, 10:27 PM
Synchronization timeJul 22, 2026, 11:47 AM
Source statusComplete
LicenseMIT; preserved notice
Stable internal citationextortion.wiki. Blackbasta ransomware notes. ThreatLabz/ransomware_notes snapshot 2bbf5b4ecda84837c4a71af1a99c6821920f051a. https://extortion.wiki/notes/blackbasta/.