Black Basta

THREAT ACTOR PROFILE

Black Basta

Black Basta was a prolific ransomware operation that emerged in 2022 with ties to the Conti lineage. It became known for social-engineering intrusions, including Microsoft Teams vishing and Quick Assist abuse, paired with loader malware and bring-your-own-vulnerable-driver evasion before encryption.

Russian-speaking operation

Ransomware (cross-sector)

First seen

2022

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Black Basta and the Storm-1811 social-engineering arm

Black Basta is tracked under the brand name and several vendor cluster names covering its intrusion and social-engineering activity. They map to one entry among the ransomware groups we monitor, so a Storm-1811 vishing report and a Black Basta advisory read as one operation.

GROUP PROFILE

Conti lineage, social-engineering intrusions

Black Basta ran a ransomware operation with roots in the Conti ecosystem. It is widely assessed as a Russian-speaking group, and it built its reputation on well-practiced social engineering rather than mass exploitation.

Our record ties it to ransomware across many sectors. It descends from Conti, and after its internal chat logs leaked in 2025, former affiliates scattered and some began automating executive targeting under new banners.

The group's signature was email-bombing a target, then calling as "IT support" over Microsoft Teams and walking the victim into granting remote access through Quick Assist. From there it ran loaders, stole data and deployed ransomware.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Vishing and loaders into BYOVD and encryption

The stages below come from Black Basta activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

Loaders, BYOVD and the Black Basta encryptor

Initial Access

CVES EXPLOITED

A Windows elevation zero-day

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

Black Basta

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

Black Basta

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

Black Basta

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Embedded BYOVD and affiliate drift

Recent reporting tracks the group's tooling and what its people did after the leaks.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.