Archive — US — techcrunch
A huge trove of leaked Black Basta chat logs expose the ransomware gang’s keymembers and victims
Leaked chat logs from the Black Basta ransomware group reveal key members and victims, shedding light on internal conflicts and operational details. The 200,000 messages, obtained by threat intelligence firm Prodaft, span from September 2023 to 2024 and show the group's connections to recent attacks on critical infrastructure, including U.S. healthcare and British companies.
Key points
- Chat logs comprise over 200,000 messages from Black Basta gang between Sept 2023 and 2024.
- Internal conflicts emerge as members fail to deliver decryption tools after ransom is paid.
- Leaker, alias 'ExploitWhispers', claims the group targeted Russian domestic banks.
- Key members identified: YY (admin), Lapa (leader), Cortes (Qakbot link), Trump/Oleg Nefedovaka (main boss).
- Logs indicate exploitation of vulnerabilities in Citrix, Ivanti, Palo Alto Networks, and Fortinet.
- 370+ unique links related to targeted companies indicate extensive research conducted by the hackers.
Why it matters
- Leaked logs relate to the ongoing threat of ransomware attacks, especially in critical sectors.
- Historically, ransomware groups like Conti and their operations are linked to geopolitical conflicts.
- The emergence of young hackers, as mentioned in the chats, reflects the evolving landscape of cybercrime.
The leak provides crucial insights into the operations of Black Basta, highlighting internal dissent and the serious implications of ransomware attacks on global infrastructure. As cyber threats evolve, understanding these dynamics is essential for cybersecurity efforts.