Activity timeline
BlackBasta appears in 4 tracked threats between and ; the busiest month was 2026-06 with 2 reports.
ATT&CK techniques observed
- T1059 Command and Scripting Interpreter — Executionobserved in 4 of 4 tracked threats
- T1071 Application Layer Protocol — Command and Controlobserved in 4 of 4 tracked threats
- T1003 OS Credential Dumping — Credential Accessobserved in 3 of 4 tracked threats
- T1018 Remote System Discovery — Discoveryobserved in 3 of 4 tracked threats
- T1021 Remote Services — Lateral Movementobserved in 3 of 4 tracked threats
- T1068 Exploitation for Privilege Escalation — Privilege Escalationobserved in 3 of 4 tracked threats
- T1078 Valid Accounts — Initial Accessobserved in 3 of 4 tracked threats
- T1087 Account Discovery — Discoveryobserved in 3 of 4 tracked threats
- T1486 Data Encrypted for Impact — Impactobserved in 3 of 4 tracked threats
- T1490 Inhibit System Recovery — Impactobserved in 3 of 4 tracked threats
- T1046 Network Service Discovery — Discoveryobserved in 2 of 4 tracked threats
- T1048 Exfiltration Over Alternative Protocol — Exfiltrationobserved in 2 of 4 tracked threats
- T1070 Indicator Removal — Stealth (formerly Defense Evasion)observed in 2 of 4 tracked threats
- T1082 System Information Discovery — Discoveryobserved in 2 of 4 tracked threats
- T1090 Proxy — Command and Controlobserved in 2 of 4 tracked threats
Tracked threats
- SystemBC (Coroxy) Malware: Tor-Based SOCKS5 Proxy Backdoor Enabling Ransomware Persistence and C2 ObfuscationCRITICAL
- Capita Black Basta Ransomware Incident (March 2023) — Record £14M UK ICO Fine for 6M+ Affected IndividualsHIGH
- Veeam Backup & Replication 8 Critical Vulnerabilities — Domain User to Backup Server RCE (CVE-2026-21666, CVE-2026-21667, CVE-2026-21669, CVE-2026-21708)CRITICAL
- Black Basta Ransomware: Internal Chat Leaks Expose $100M+ RaaS Operation — Conti Successor UnmaskedHIGH