type: malware
spec_version: 2.1
id: malware--8d242fb4-9033-4f13-8a88-4b9b4bcd9a53
created: 2023-03-08T19:14:27.348Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1070
external_id: S1070
source_name: Avertium Black Basta June 2022
description: Avertium. (2022, June 1). AN IN-DEPTH LOOK AT BLACK BASTA RANSOMWARE. Retrieved March 7, 2023.
url: https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware
source_name: Cyble Black Basta May 2022
description: Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.
url: https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/
source_name: Palo Alto Networks Black Basta August 2022
description: Elsad, A. (2022, August 25). Threat Assessment: Black Basta Ransomware. Retrieved March 8, 2023.
url: https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware
source_name: NCC Group Black Basta June 2022
description: Inman, R. and Gurney, P. (2022, June 6). Shining the Light on Black Basta. Retrieved March 8, 2023.
url: https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/
source_name: Deep Instinct Black Basta August 2022
description: Vilkomir-Preisman, S. (2022, August 18). Beating Black Basta Ransomware. Retrieved March 8, 2023.
url: https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence
source_name: Minerva Labs Black Basta May 2022
description: Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023.
url: https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T03:10:03.937Z
name: Black Basta
description: [Black Basta](https://attack.mitre.org/software/S1070) is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. [Black Basta](https://attack.mitre.org/software/S1070) operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. [Black Basta](https://attack.mitre.org/software/S1070) affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the [Black Basta](https://attack.mitre.org/software/S1070) RaaS operators could include current or former members of the [Conti](https://attack.mitre.org/software/S0575) group.(Citation: Palo Alto Networks Black Basta August 2022)(Citation: Deep Instinct Black Basta August 2022)(Citation: Minerva Labs Black Basta May 2022)(Citation: Avertium Black Basta June 2022)(Citation: NCC Group Black Basta June 2022)(Citation: Cyble Black Basta May 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
ESXi
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Daniyal Naeem, BT Security
Mathieu Hinse
Inna Danilevich, U.S. Bank
Natthawut Saexu
x_mitre_aliases: Black Basta