A Huge Trove Of Leaked Black Basta Chat Logs Expose The Ransomware Gangs Key Members And Victims

A trove of chat logs allegedly belonging to the Black Basta ransomware group has leaked online, exposing key members of the prolific Russia-linked gang.

The chat logs, which include over 200,000 messages spanning from September 18, 2023, to September 28, 2024, were shared with threat intelligence company Prodaft by a leaker. The cybersecurity firm says the leak comes amid “internal conflict” within the Black Basta group after some members allegedly failed to provide its victims with functional decryption tools despite paying a ransom demand.

It’s not yet known if the leaker, who uses the alias “ExploitWhispers” on Telegram, was a member of the Black Basta gang.

Black Basta is a prolific Russian-language ransomware gang, which the U.S. government has linked to hundreds of attacks on critical infrastructure and global businesses , whose publicly known victims include U.S. healthcare organization Ascension , U.K. utility company Southern Water , and British outsourcing giant Capita . The leaked chat logs give a never-before-seen look inside the ransomware gang, including some of its unreported targets.

According to a post on X by Prodaft , the leaker said that the hackers “crossed the line” by targeting Russian domestic banks.

“So we are dedicated to uncovering the truth and investigating Black Basta’s steps,” the leaker wrote.

TechCrunch obtained a copy of the hackers’ chat logs from Prodaft, which contain details key members of the ransomware gang.

These members include “YY” (Black Basta’s main administrator); “Lapa” (another of Black Basta’s key leaders); “Cortes” (a hacker linked to the Qakbot botnet ); and “Trump” (also known as “AA” and “GG”).

The hacker “Trump” is believed to be an alias used by Oleg Nefedovaka, who Prodaft researchers describe as “the group’s main boss.” The researchers linked Nefedovaka to the now-defunct Conti ransomware group, which shut down soon after its internal chat logs leaked following the gang declared its support for Russia’s full-scale invasion of Ukraine in 2022.

The leaked Black Basta chat logs also quote one member as saying they are 17-years-old, TechCrunch has seen.

The chat logs also reveal unprecedented insights into the group’s operations. The messages include details on Black Basta’s victims, copies of phishing templates used in their cyberattacks, some of the exploits used by the gang, cryptocurrency addresses associated with ransom payments, and details ransom demands and victims’ negotiations with hacked organizations.

We also found chat logs of the hackers discussing a TechCrunch article ongoing Qakbot activity, despite an earlier FBI takedown operation aimed at knocking the notorious botnet offline .

TechCrunch also found chat logs that named several previously unknown targeted organizations. This includes the failed U.S. automotive giant Fisker ; health tech provider Cerner Corp., which is now owned by Oracle; and U.K.-based travel firm Hotelplan. It is not yet known if the companies were breached, and none of the companies responded to TechCrunch’s inquiries.

The chat logs appear to show the gang’s efforts in exploiting security bugs in enterprise network devices , such as routers and firewalls that sit on the perimeter of a company’s network and act as digital gatekeepers.

The hackers boasted their ability to exploit vulnerabilities in Citrix remote access products to break into at least two company networks. The gang also talked exploiting vulnerabilities in Ivanti, Palo Alto Networks, and Fortinet software to carry out cyberattacks.

A conversation between Black Basta members also suggests that some of the group were worried being investigated by Russian authorities in response to geopolitical pressures. While Russia has long been a safe haven for ransomware gangs, Black Basta was also concerned actions brought by the U.S. government.

Messages sent after the group’s breach of Ascension’s systems warned that the FBI and CISA are “100% obliged” to get involved and could lead to the agencies “taking a tough stance on Black Basta.”

Black Basta’s dark web leak site, which it uses to publicly extort victims into paying the gang a ransom demand, was offline at the time of publication.