← All threat actors
Black Bastamalware / toolS1070 ↗
Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers.
Reports / IOCs (VT)
112 reports · 20 IOCs
Reported activity
2022 – 2026
Used by
CVEs seen in reporting
ATT&CK techniques in reports
- T1112 Modify Registry4
- T1082 System Information Discovery3
- T1486 Data Encrypted for Impact3
- T1489 Service Stop3
- T1490 Inhibit System Recovery3
- T1562.009 Safe Mode Boot3
- T1566.001 Spearphishing Attachment3
- T1569.002 Service Execution3
- T1016 System Network Configuration Discovery2
- T1018 Remote System Discovery2
- T1021 Remote Services2
- T1140 Deobfuscate/Decode Files or Information2
- T1218.010 Regsvr322
- T1491 Defacement2
- T1573 Encrypted Channel2
- T1071 Application Layer Protocol2
- T1095 Non-Application Layer Protocol2
- T1102 Web Service2
- T1189 Drive-by Compromise2
- T1571 Non-Standard Port2
Also known as
no_name_software