What was the Black Basta leak?
In early 2025, a large archive of internal Black Basta chat logs was leaked publicly and made available via a Telegram channel associated with an apparent disgruntled insider. Security researchers, including PRODAFT, Hudson Rock, and Qualys researchers, analyzed and summarized the contents. The archive contained conversations among operators and affiliates spanning roughly late 2023 through 2024, covering initial-access purchases, tool usage, victim negotiations, and internal disputes.
The leak is analogous to the earlier Conti chat leak of 2022 in research value: it is rare ground truth about how a ransomware program actually ran, as opposed to how it is inferred to have run from the outside.
What does Black Basta actually do?
Black Basta first appeared publicly in April 2022. CISA and partners published a joint advisory (AA24-131A) in May 2024 describing tactics including phishing, exploitation of known CVEs (such as ConnectWise ScreenConnect CVE-2024-1709 and older vulnerabilities in Citrix and Fortinet gear), abuse of Qakbot and later other loaders for initial access, and deployment of a ransomware encryptor that performs standard double extortion. The group has been publicly associated with attacks across healthcare, government, and manufacturing sectors.
That context matters because the leak's content largely reinforced what the CISA advisory described, with added operational color.
What did the leak tell us about initial access economics?
Answer first: initial access is a commodity market and Black Basta operators shopped it actively.
Observations from public analyses of the chats:
- Operators discussed purchasing valid VPN credentials and compromised endpoint footholds from initial-access brokers at prices ranging roughly from low hundreds of dollars to several thousand, depending on the target's revenue profile.
- Qakbot was a frequent delivery mechanism historically. After the August 2023 Qakbot disruption (Operation Duck Hunt), operators discussed shifting to DarkGate, Pikabot, and other loaders.
- Price sensitivity was real. Operators balanced access cost against expected extortion yield. Larger enterprises were worth higher upfront access spend.
Defender takeaway: the broker economy is the lever your detection and identity hardening fights against. Every identity that leaks, every legacy VPN, every un-MFA'd service account is something for sale at a price.
What did the chats say about EDR evasion?
Operators discussed specific EDR vendors by name and traded tradecraft on which vendors they found easiest or hardest to evade. This matched external reporting:
- BYOVD tooling came up in multiple conversations. Operators shared experiences with drivers useful for disabling endpoint agents.
- Living-off-the-land patterns (PowerShell, WMI, scheduled tasks) were preferred when the target had a well-tuned EDR because the noise ratio favored attackers.
- Operators complained when a target had genuinely hardened WDAC or application-control policies. That is a useful data point for anyone debating whether application control is worth the rollout cost.
There is a consistent theme across ransomware leaks: if you make the attacker's next step require custom work, you push them to an easier target. The chats were blunt about which targets were not worth the effort.
What did the leak reveal about internal operations?
Several things worth internalizing:
- Operators and affiliates were not uniformly skilled. Some engagements were run by affiliates who struggled with basic Active Directory concepts.
- Management disputes, payment complaints, and affiliate churn were frequent. The "nation-state-level discipline" narrative around top ransomware programs is more marketing than reality.
- Legal exposure was on their minds. Chats included discussion of which jurisdictions posed risk, which sectors were politically "hot" (e.g., hospitals after certain public incidents), and internal debates over targeting rules.
None of this is exculpatory. It does, however, ground defenders' expectations: you are not necessarily facing a flawless adversary, and your detection does not need to be perfect. It needs to be good enough to push this affiliate to the next name on the list.
What should defenders actually do with this?
- Audit your VPN and identity attack surface for broker-grade weaknesses. Shared credentials, non-MFA service accounts, legacy appliances with default creds, stale partner accounts. These are the things brokers are selling.
- Invest in loader detection, not just final-stage ransomware detection. By the time you see the encryptor, the incident is already bad. Qakbot, DarkGate, Pikabot, and successors have distinctive behaviors (parent-child processes, scheduled task creation, rundll32 invocation) that are reliably catchable.
- Plan for ConnectWise ScreenConnect and remote-management tooling abuse. The CVE-2024-1709 exploitation wave was a major Black Basta enabler. Keep a hard inventory of which remote-management agents are authorized on which hosts, and block the rest.
- Enforce phishing-resistant MFA everywhere, not just on SSO. Remote-access VPNs and legacy workflows are the gaps attackers shop for.
- Prepare for on-host healthcare-sector pressures specifically. Black Basta has been linked to healthcare victims multiple times; the regulatory and life-safety stakes there change how IR decisions are made.
What do the leaks not tell us?
They do not cleanly answer attribution questions about state involvement, which some reporting has speculated about. They do not resolve whether Black Basta has a formal relationship with other brands. They do not give defenders a decryptor. And they do not describe the full victim footprint, since many negotiations happened out-of-band on separate channels.
Treat the leak as high-quality color on a picture you already mostly had, not as a rewrite of the ransomware threat model.
What is the longer-term lesson across ransomware leaks?
Conti's leak in 2022 and Black Basta's leak in 2025 agree on a few structural truths:
- The economic model is durable. Prices may drift; the market functions.
- Affiliates rotate across brands. Your detection engineering should target tradecraft, not logos.
- Many victim intrusions involved third-party gateways: an MSP, a vendor-installed remote-access agent, a SaaS admin console.
- The organizations that recovered fastest had immutable, off-domain backups, and a rehearsed IR playbook. Not new advice. Still the advice that matters.
What does this mean for supply chain risk specifically?
Several Black Basta-associated intrusions began at MSPs or at specific vendor products, per public victim disclosures and the CISA advisory. The pattern we have discussed in posts on LockBit and RansomHub holds: the ransomware program is the final-stage brand, but the supply chain is the entry. Your vendor inventory, their patch posture, and your shared identity topology are upstream of whose logo ends up on the leak site.
How Safeguard.sh Helps
Safeguard.sh continuously maps your exposure to the entry points that appear repeatedly in ransomware leaks: MSP tenants, remote-management agents, VPN appliances, exposed admin consoles, and shared-identity surfaces. We track the CVEs and tools that affiliates are actively discussing and deploying, correlate those against your third-party inventory, and elevate findings where a vendor's posture is drifting in the direction of the next likely intrusion. When the next chat leak happens, the patterns it reveals should already be in your dashboard.