S1070: Black Basta
Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. Black Basta operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. Black Basta affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the Black Basta RaaS operators could include current or former members of the Conti group.[1][2][3][4][5][6]
Security context for executives and security teams
S1070: Black Basta describes [Black Basta](https://attack.mitre.org/software/S1070) is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. [Black Basta](https://attack.mitre.org/software/S1070) operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site...
Executive priority
S1070: Black Basta is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1070: Black Basta by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows, ESXi), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1070: Black Basta appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Black Basta
Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. Black Basta operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. Black Basta affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the Black Basta RaaS operators could include current or former members of the Conti group.[1][2][3][4][5][6]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1490 | Inhibit System Recovery | |
| Enterprise | T1082 | System Information Discovery | Black Basta can collect system boot configuration and CPU information.[3][6] |
| Enterprise | T1553.002 | Code SigningSub-technique | The Black Basta dropper has been digitally signed with a certificate issued by Akeo Consulting for legitimate executables used for creating bootable USB drives.CitationCheck Point Black Basta October 2022 |
| Enterprise | T1497 | Virtualization/Sandbox Evasion | Black Basta can make a random number of calls to the `kernel32.beep` function to hinder log analysis.CitationCheck Point Black Basta October 2022 |
| Enterprise | T1491.001 | Internal DefacementSub-technique | |
| Enterprise | T1018 | Remote System Discovery | Black Basta can use LDAP queries to connect to AD and iterate over connected workstations.CitationCheck Point Black Basta October 2022 |
| Enterprise | T1112 | Modify Registry | |
| Enterprise | T1083 | File and Directory Discovery | |
| Enterprise | T1486 | Data Encrypted for Impact | Black Basta can encrypt files with the ChaCha20 cypher and using a multithreaded process to increase speed.[3]CitationBlackBerry Black Basta May 2022[6][5]CitationUptycs Black Basta ESXi June 2022[2][1]CitationTrend Micro Black Basta Spotlight September 2022CitationCheck Point Black Basta October 2022 Black Basta has also encrypted files while the victim system is in safe mode, appending `.basta` upon completion.CitationTrend Micro Black Basta May 2022 |
| Enterprise | T1622 | Debugger Evasion | The Black Basta dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.CitationCheck Point Black Basta October 2022 |
| Enterprise | T1204.002 | Malicious FileSub-technique | Black Basta has been downloaded and executed from malicious Excel files.CitationTrend Micro Black Basta May 2022CitationTrend Micro Black Basta Spotlight September 2022 |
| Enterprise | T1222.002 | Linux and Mac PermissionsSub-technique | The Black Basta binary can use `chmod` to gain full permissions to targeted files.CitationUptycs Black Basta ESXi June 2022 |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | Black Basta can use `cmd.exe` to enable shadow copy deletion.[2] |
| Enterprise | T1007 | System Service Discovery | Black Basta can check whether the service name `FAX` is present.[6] |
| Enterprise | T1680 | Local Storage Discovery | Black Basta can enumerate volumes.[3][6] |
| Enterprise | T1497.001 | System ChecksSub-technique | Black Basta can check system flags and libraries, process timing, and API's to detect code emulation or sandboxing.[1]CitationCheck Point Black Basta October 2022 |
| Enterprise | T1059.001 | PowerShellSub-technique | Black Basta has used PowerShell scripts for discovery and to execute files over the network.CitationTrend Micro Black Basta May 2022CitationTrend Micro Black Basta Spotlight September 2022[5] |
| Enterprise | T1543.003 | Windows ServiceSub-technique | Black Basta can create a new service to establish persistence.[3][4] |
| Enterprise | T1047 | Windows Management Instrumentation | Black Basta has used WMI to execute files over the network.[5] |
| Enterprise | T1688 | Safe Mode Boot | Black Basta can reboot victim machines in safe mode with networking via `bcdedit /set safeboot network`.[3][6]CitationTrend Micro Black Basta May 2022[4][1] |
| Enterprise | T1027.001 | Binary PaddingSub-technique | Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.CitationCheck Point Black Basta October 2022 |
| Enterprise | T1106 | Native API | Black Basta has the ability to use native APIs for numerous functions including discovery and defense evasion.[3][6][4]CitationCheck Point Black Basta October 2022CitationTrend Micro Black Basta May 2022 |
| Enterprise | T1529 | System Shutdown/Reboot | Black Basta has used `ShellExecuteA` to shut down and restart the victim system.CitationTrend Micro Black Basta May 2022 |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | The Black Basta dropper has mimicked an application for creating USB bootable drivers.CitationCheck Point Black Basta October 2022 |
| Enterprise | T1480.002 | Mutual ExclusionSub-technique | Black Basta will check for the presence of a hard-coded mutex `dsajdhas.0` before executing.[2] |
| Enterprise | T1036.004 | Masquerade Task or ServiceSub-technique | Black Basta has established persistence by creating a new service named `FAX` after deleting the legitimate service by the same name.[3][6]CitationTrend Micro Black Basta May 2022 |
Groups, software, and campaigns
G1046: Storm-1811
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.[1][2][3][4]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.2 | Current bundle | 866178ff7606… | ||
| 19.1 | 1.2 | Older bundle | 866178ff7606… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Palo Alto Networks Black Basta August 2022
Elsad, A. (2022, August 25). Threat Assessment: Black Basta Ransomware. Retrieved March 8, 2023.
Open source URL - [2]Deep Instinct Black Basta August 2022
Vilkomir-Preisman, S. (2022, August 18). Beating Black Basta Ransomware. Retrieved March 8, 2023.
Open source URL - [3]Minerva Labs Black Basta May 2022
Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023.
Open source URL - [4]Avertium Black Basta June 2022
Avertium. (2022, June 1). AN IN-DEPTH LOOK AT BLACK BASTA RANSOMWARE. Retrieved March 7, 2023.
Open source URL - [5]NCC Group Black Basta June 2022
Inman, R. and Gurney, P. (2022, June 6). Shining the Light on Black Basta. Retrieved March 8, 2023.
Open source URL - [6]Cyble Black Basta May 2022
Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.
Open source URL - [7]mitre-attackS1070Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.