malware family

Black Basta

unknownentity:malware_familyransomware · 1 source

[Black Basta](https://attack.mitre.org/software/S1070) is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. [Black Basta](https://attack.mitre.org/software/S1070) operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive inform

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: black-basta
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 6 · 0 attributions · 1 relations · 0 events

Identifiers

attack S1070via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatStorm-1811usesBlack Basta
fetch —sha256 dc1639caa5501d72
rel_149btcintel:relations:149@v1 sha256:59331957ecbeb67d
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 6 of 6

Black Bastaransomwarepayment
subjecttransaction62c888408a…abab7702e9
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1GnkF1JtPT6EJcgJRFjArKZHjQs873eUeE · 43,000,000 sat · time 2022-12-08 03:17 UTC · url https://ransomwhe.re/#address/1GnkF1JtPT6EJcgJRFjArKZHjQs873eUeE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32305btcintel:annotations:32305@v3 sha256:8d135ed5611388b7
confidencetrusted provider · 50
Black Bastaransomwarepayment
subjecttransaction5e06aa53f8…03e1dcb657
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1GnkF1JtPT6EJcgJRFjArKZHjQs873eUeE · 2,916,000,000 sat · time 2022-12-08 03:46 UTC · url https://ransomwhe.re/#address/1GnkF1JtPT6EJcgJRFjArKZHjQs873eUeE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32304btcintel:annotations:32304@v3 sha256:73a2d97263c8fdb1
confidencetrusted provider · 50
Black Bastaransomwarepayment address
subjectaddress1GnkF1JtPT6EJcgJRFjArKZHjQs873eUeE
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Black Basta · url https://ransomwhe.re/#address/1GnkF1JtPT6EJcgJRFjArKZHjQs873eUeE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32303btcintel:annotations:32303@v2 sha256:61fcf37b4602b75f
confidencetrusted provider · 50
Black Bastaransomwarepayment
subjecttransactione79d0f43b6…12f88b6fdb
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 13rhLTYUKo9ijrR8vinojZqoZTpTe1fm8c · 5,000 sat · time 2022-10-11 17:00 UTC · url https://ransomwhe.re/#address/13rhLTYUKo9ijrR8vinojZqoZTpTe1fm8c
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32302btcintel:annotations:32302@v3 sha256:bd27547ad9cc86b1
confidencetrusted provider · 50
Black Bastaransomwarepayment
subjecttransaction1b70e503a8…3082b8b243
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 13rhLTYUKo9ijrR8vinojZqoZTpTe1fm8c · 1,561,359,882 sat · time 2022-10-12 22:23 UTC · url https://ransomwhe.re/#address/13rhLTYUKo9ijrR8vinojZqoZTpTe1fm8c
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32301btcintel:annotations:32301@v3 sha256:6e86f03ae3f893b1
confidencetrusted provider · 50
Black Bastaransomwarepayment address
subjectaddress13rhLTYUKo9ijrR8vinojZqoZTpTe1fm8c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Black Basta · url https://ransomwhe.re/#address/13rhLTYUKo9ijrR8vinojZqoZTpTe1fm8c
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32300btcintel:annotations:32300@v2 sha256:d00f3cf9f688727f
confidencetrusted provider · 50

Subjects6 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.