# Black Basta Ransomware: Internal Chat Leaks Expose $100M+ RaaS Operation — Conti Successor Unmasked

> Black Basta ransomware operation's internal Matrix chat logs were leaked on February 11, 2025 by an individual known as 'ExploitWhispers,' exposing operational structure, key operators, TTPs, affiliate management, and ransom negotiation tactics from September 2023 to September 2024. The leak — described as closely resembling the 2022 Conti leaks — was allegedly motivated by Black Basta targeting Russian banks. PRODAFT confirmed the group had been mostly inactive since early 2025 due to internal conflicts, with some operators scamming victims by collecting ransom payments without providing functional decryptors. Key operators identified: Tramp/GG/AA (believed to be Oleg Nefedov, group leader), YY (main administrator), Lapa (operations admin), and Cortes (linked to QakBot group). Since April 2022, Black Basta affiliates breached 500+ organizations across 12 of 16 critical infrastructure sectors, collecting an estimated $100M+ in ransom payments from 90+ victims through November 2023 alone.

- **Published:** 2026-02-12T06:20:00Z
- **Last reviewed:** 2026-02-12T06:20:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0071
- **ID:** TL-2026-0071
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** SUPERSEDED
- **Actor:** Black Basta (Russia)
- **Detections:** 12 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-1709, CVE-2020-1472, CVE-2021-42278, CVE-2021-42287, CVE-2021-34527

## Description

Black Basta is a Ransomware-as-a-Service (RaaS) operation that emerged in April 2022, widely assessed as a successor to the Conti ransomware syndicate. On February 11, 2025, an individual using the alias 'ExploitWhispers' leaked an archive of internal Matrix chat logs spanning September 18, 2023 to September 28, 2024 — first to MEGA (removed), then to a dedicated Telegram channel. PRODAFT attributed the leak to internal conflicts and alleged that it resulted from Black Basta targeting Russian banks, drawing parallels to the 2022 Conti leak (triggered by Conti siding with Russia during the Ukraine invasion).

KEY OPERATORS IDENTIFIED FROM CHAT LOGS:
- **Tramp** (aliases: GG, AA) — Believed to be Oleg Nefedov. Group leader/boss. Strategic decision-maker.
- **YY** — Main administrator. Manages operations and infrastructure.
- **Lapa** — Operations admin. Handles day-to-day operational coordination.
- **Cortes** — Linked to the QakBot (Qbot) group. Handles initial access distribution.

OPERATIONAL INTELLIGENCE FROM LEAKED CHATS:
BleepingComputer analysis of the leaked messages revealed:
- Phishing templates and ready-to-send email lures
- Cryptocurrency wallet addresses (payment infrastructure)
- Data drops (exfiltration staging locations)
- Victim credentials (harvested during operations)
- 367 unique ZoomInfo links — indicating targeted companies
- Confirmation of previously reported TTPs
- Internal conflicts: some operators scamming victims by collecting payments WITHOUT providing functional decryptors

INTERNAL CONFLICTS AND OPERATIONAL DECLINE:
PRODAFT observed Black Basta (tracked as 'Vengeful Mantis') had been mostly inactive since early 2025 due to internal conflicts. The decryptor scam — operators pocketing ransom payments without delivering working decryption tools — eroded trust within the operation and likely motivated the leak. This pattern mirrors Conti's decline: internal conflicts → leak → operational collapse.

TTPs FROM CISA ADVISORY (AA24-131A) + CHAT LEAK CONFIRMATION:

INITIAL ACCESS:
- Spearphishing with malicious attachments (T1566.001)
- QakBot delivery for initial foothold (via Cortes/QakBot affiliate)
- DarkGate loader distribution
- Exploitation of ConnectWise CVE-2024-1709 (Feb 2024+)
- Valid credential abuse (T1078)
- Email bombing + social engineering via Microsoft Teams (May 2024+) — mass spam emails followed by phone calls posing as IT support, directing victims to install AnyDesk or Quick Assist
- Voice phishing (vishing) campaigns targeting employees

DISCOVERY AND RECONNAISSANCE:
- SoftPerfect Network Scanner (netscan.exe) for network mapping
- Utilities disguised with innocuous names (Intel, Dell) in C:\ root
- WMI, SNMP, SSH, PowerShell for remote system enumeration

PRIVILEGE ESCALATION:
- Mimikatz for credential dumping
- ZeroLogon (CVE-2020-1472) exploitation
- NoPac (CVE-2021-42278, CVE-2021-42287) exploitation
- PrintNightmare (CVE-2021-34527) exploitation

LATERAL MOVEMENT:
- BITSAdmin for file transfer
- PsExec for remote execution
- Remote Desktop Protocol (RDP)
- Splashtop and ScreenConnect for remote access
- Cobalt Strike beacons

EXFILTRATION AND ENCRYPTION:
- RClone to cloud storage (Mega) for data exfiltration
- PowerShell to disable antivirus
- Backstab tool to disable EDR (T1562.001)
- ChaCha20 encryption with RSA-4096 public key
- File extension: .basta or random extension
- Ransom note: readme.txt
- VSS deletion via vssadmin.exe
- 10-12 day payment deadline before data publication on 'Basta News' Tor site

HIGH-PROFILE VICTIMS:
Rheinmetall (German defense), Hyundai Europe, BT Group (British Telecom), Ascension Healthcare (ambulance diversions), ABB (government contractor), American Dental Association, Capita (UK outsourcing), Toronto Public Library, Yellow Pages Canada.

CONTI SUCCESSION:
Black Basta is widely assessed as a Conti successor operation. The parallels between the Black Basta chat leak and the 2022 Conti leak are striking:
- Conti: 170,000+ chat messages leaked after siding with Russia → operational collapse
- Black Basta: Internal Matrix logs leaked after targeting Russian banks → operational decline
Both demonstrate that ransomware operations are vulnerable to internal dissent when political/national loyalties conflict with operational security.

FINANCIAL SCALE:
- $100M+ collected from 90+ victims through November 2023 (Corvus Insurance/Elliptic research)
- 500+ organizations breached globally (April 2022 - May 2024, FBI/CISA)
- 12 of 16 US critical infrastructure sectors impacted
- 367 ZoomInfo links = targeted company research in leaked chat period alone

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1588 Obtain Capabilities
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1569 System Services
- T1133 External Remote Services
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1567 Exfiltration Over Web Service
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1596 Search Open Technical Databases
- T1589 Gather Victim Identity Information
- T1594 Search Victim-Owned Websites
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1047 Windows Management Instrumentation
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1110 Brute Force
- T1558 Steal or Forge Kerberos Tickets
- T1082 System Information Discovery

## Sources

- [BleepingComputer: Black Basta internal chat logs leak online](https://www.bleepingcomputer.com/news/security/black-basta-ransomware-gang-s-internal-chat-logs-leak-online/)
- [CISA/FBI: #StopRansomware — Black Basta Advisory AA24-131A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a)
- [PRODAFT: Black Basta (Vengeful Mantis) internal conflict analysis](https://x.com/PRODAFT/status/1892636346885235092)
- [SentinelOne: Black Basta custom EDR evasion tools linked to FIN7](https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/)
- [Unit 42: Black Basta Threat Assessment](https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/)
- [Corvus/Elliptic: Black Basta $100M+ ransom revenue analysis](https://www.bleepingcomputer.com/news/security/black-basta-ransomware-made-over-100-million-from-extortion/)
- [Kroll: Black Basta Technical Analysis](https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0071