193 victims listed on the Blackbasta leak site across 21 countries.
Most recent disclosure .
Victims
193
0.8% of all tracked
Countries
21
Most: United States
Sectors
12
Most: Business Services
First seen
Jan 2024
In this database
ThreatAI analysis
Compiled from the ransomware.live profile for Blackbasta and from this database. Figures and technique mappings are quoted from the source data, not inferred.
Blackbasta, a newly identified ransomware strain, has infected 193 victims in 21 countries since at least February of this year.
Who Blackbasta is
"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.
Recorded activity
Disclosures attributed to Blackbasta in this database run from January 2024 to January 2025, totalling 193 victims — 0.8% of everything tracked here. Blackbasta has listed victims in 21 countries in this database, most often United States, followed by United Kingdom and Germany. The sectors appearing most in its listings are Business Services, Manufacturing, Technology.
How Blackbasta is documented to operate
Windows Management InstrumentationT1047Execution
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model and Windows Remote Management. Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Mitigations:
Execution Prevention, Behavior Prevention on Endpoint, User Account Management, Privileged Account Management
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.
Mitigations:
Operating System Configuration, Network Segmentation, User Account Management, Restrict File and Directory Permissions, Privileged Account Management, Multi-factor Authentication
Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
8 of these 8 are in the CISA Known Exploited Vulnerabilities catalog, 8 of them recorded by CISA as used in ransomware campaigns. CVEs attributed to Blackbasta in threat intelligence reporting. Patching these does not by itself rule the group out, and their presence here is not evidence of how any single organisation was reached.
Tooling observed in Blackbasta operations
Mimikatz
AdFind
Bloodhound
PSNmap
PowerView
SoftPerfect NetScan
Qaz[.]im
RClone
BITSAdmin
PsExec
Quick Assist
Brute Ratel C4
Software reported in use by Blackbasta. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.
Threat actor analysis
Blackbasta has disclosed 193 victims
on its leak site, 0.8% of all ransomware listings tracked in this database.
Its earliest disclosure here dates to January 2024.
The group has listed organisations in 21 countries,
most often in United States
(110 victims),
followed by United Kingdom, Germany, Canada.
By industry, its listings concentrate in Business Services, Manufacturing, Technology —
sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.
Like most current ransomware operations, Blackbasta is likely to use double extortion:
data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site
with the stolen data as leverage.
Blackbasta is a ransomware threat group that has claimed 193 victims since its first known activity in January 2024. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.
How many victims has Blackbasta attacked?
Blackbasta has claimed 193 victims in our database, representing 0.8% of all tracked ransomware attacks. The most targeted countries are United States, United Kingdom, Germany, Canada.
Which countries does Blackbasta target?
Blackbasta has attacked organizations in 21 countries. The top targeted countries are: United States, United Kingdom, Germany, Canada.
Which industries does Blackbasta target?
Blackbasta most frequently targets the Business Services, Manufacturing, Technology sectors based on victim disclosures in our database.
Is Blackbasta still active?
Blackbasta's most recent victim disclosure in our database was on January 11, 2025. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.
This site uses cookies for analytics and advertising.
Cookie policy
CTI Digest
Every Monday, the 5 threats SOC teams can't afford to miss — with analyst commentary.
