Incidents

Black Basta

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware490 leak-site claims, all timeLatest observed leak-site post 2025-01-11

ORKL search ↗

Portable threat brief

Black Basta

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor: Black Basta
Kind: ransomware
Latest observed: 2025-01-11
Leak-site claims: 490
Catalogued techniques: 0

Scope

Tracked sectors: Manufacturing, Construction & Engineering, Retail, Financial Services, Legal
Claim records: 2022-08-18 to 2025-01-11
News stories naming this group: 2024-05-14 to 2026-10-27

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsManufacturingConstruction & EngineeringRetailFinancial ServicesLegal

Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records: First observed 2022-08-18Latest observed 2025-01-11
News stories naming this group: First observed 2024-05-14Latest observed 2026-10-27

Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand

490 on this site

schuff.comConstruction & Engineering2025-01-11source ↗
granbyindustries.comManufacturing2025-01-11source ↗
plasmatherm.comManufacturing2025-01-11source ↗
arunestates.co.ukReal Estate2025-01-11source ↗
brachot.comManufacturing2025-01-11source ↗
avril.caRetail2025-01-11source ↗
migonline.comFinancial Services2025-01-11source ↗
bnext.nlConstruction & Engineering2025-01-11source ↗
activedynamics.comTechnology2024-12-18source ↗
bender.deSector not stated by source2024-12-18source ↗

View all on Breaches →

Leak-site claim activity

Claims per month, 2022-08 to 2025-01. Peak 76 in 2022-08.

2022-082025-01

Show monthly counts as a table

Month	Claims
2022-08	76
2022-09	22
2022-10	28
2022-11	9
2022-12	15
2023-01	0
2023-02	0
2023-03	10
2023-04	20
2023-05	8
2023-06	11
2023-07	5
2023-08	20
2023-09	0
2023-10	18
2023-11	41
2023-12	14
2024-01	17
2024-02	24
2024-03	35
2024-04	21
2024-05	18
2024-06	17
2024-07	5
2024-08	0
2024-09	2
2024-10	12
2024-11	15
2024-12	19
2025-01	8

0 additional claims without a disclosure date

News stories naming this group

10 on this site

2026-10-27vulnerabilitiesAttackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes
2026-09-30ransomwareRansomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report
2026-09-10ransomwareConti ransomware crew member sentenced to four years in prison
2026-06-30ransomwareHow ransomware syndicates weaponize corporate-style organization
2026-05-14ransomwareHelp-Desk Lures Drop KongTuke's Evolved ModeloRAT
2026-04-16ransomwarePayouts King Takes Aim at the Ransomware Throne
2026-04-14ransomwareAre Former Black Basta Affiliates Automating Executive Targeting?
2025-11-20regulatoryWhat organisations can learn from the record breaking fine over Capita’s ransomware incident
2025-05-13threat intelThreat Spotlight: Capitol x Kremlin: Will US Politics Reshape Russian Cyber Threats?
2024-05-14threat intelRussia-Linked Threats to Operational Technology

Ransomware claim data is unverified: RansomLook (CC BY 4.0).