Skip to content

Black Basta

Software · ATTACK:enterprise:S1070

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1070",
  "title": "Black Basta",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1070",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--8d242fb4-9033-4f13-8a88-4b9b4bcd9a53",
  "external_id": "S1070",
  "domain": "enterprise",
  "created": "2023-03-08T19:14:27.348Z",
  "modified": "2025-10-21T03:10:03.937Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Avertium Black Basta June 2022",
      "url": "https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware"
    },
    {
      "source_name": "Cyble Black Basta May 2022",
      "url": "https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"
    },
    {
      "source_name": "Palo Alto Networks Black Basta August 2022",
      "url": "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware"
    },
    {
      "source_name": "NCC Group Black Basta June 2022",
      "url": "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"
    },
    {
      "source_name": "Deep Instinct Black Basta August 2022",
      "url": "https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"
    },
    {
      "source_name": "Minerva Labs Black Basta May 2022",
      "url": "https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"
    }
  ]
}

Explicit source assertions (27)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0260e86a-488e-4307-a467-2ccabf430212

Avertium Black Basta June 2022 · Check Point Black Basta October 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Trend Micro Black Basta Spotlight September 2022 · Deep Instinct Black Basta August 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--035faa39-bed9-4aed-bbc4-80c7a653f046

Microsoft Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e714323-a3b6-4848-852c-5e35608d0970

Cyble Black Basta May 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26e2d87c-43c2-4552-9186-2ca0f70e96c7

Check Point Black Basta October 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1497

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f5dca6b-3cd3-4b2a-b097-7eddd80bc366

Check Point Black Basta October 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1491.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--314719c9-a946-4630-a09c-d416b48f4c21

Avertium Black Basta June 2022 · BlackBerry Black Basta May 2022 · Check Point Black Basta October 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Deep Instinct Black Basta August 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3341a11e-acd1-4cba-a7a9-5bb48aec8bec

Check Point Black Basta October 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5abf323d-03be-4996-ab4b-89317883d0ab

Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Deep Instinct Black Basta August 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66e7e1f3-5113-407f-a07a-299c4b9b68e2

Avertium Black Basta June 2022 · Check Point Black Basta October 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · NCC Group Black Basta June 2022 · Uptycs Black Basta ESXi June 2022 · Trend Micro Black Basta Spotlight September 2022 · Deep Instinct Black Basta August 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6aedddc0-0c82-48f0-b9cc-071d440a367c

BlackBerry Black Basta May 2022 · Check Point Black Basta October 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Uptycs Black Basta ESXi June 2022 · Trend Micro Black Basta Spotlight September 2022 · Deep Instinct Black Basta August 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1622

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bc08584-0dc8-494f-967f-50adc9464843

Check Point Black Basta October 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7423b6a3-9956-49ea-ba11-3a678994352c

Trend Micro Black Basta May 2022 · Trend Micro Black Basta Spotlight September 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1222.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8097b8e6-73f2-44f4-9234-dffa4794e0c6

Uptycs Black Basta ESXi June 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--856dc5fd-84ee-41e0-b463-0ba54f98141c

Deep Instinct Black Basta August 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b02a707-94ba-4c61-8292-d9dce02606b3

Cyble Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cef7b12-80af-4bb1-bf72-8eccd835d423

Cyble Black Basta May 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9122a590-4a01-4f41-a15a-bc3bc92b0439

Check Point Black Basta October 2022 · Palo Alto Networks Black Basta August 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9284080a-98cb-46d7-80b3-775a89d5bdfa

Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Trend Micro Black Basta Spotlight September 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a508c28d-76f7-4277-a9d2-5936f9d86e43

Avertium Black Basta June 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab5f4ee8-c7fc-4be4-bb39-0536d7d7eba3

NCC Group Black Basta June 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1688

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bce6eb76-c438-41b0-8dca-6a2d29844abd

Avertium Black Basta June 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be0b4e47-a6af-43f1-9f7c-b15cffedc290

Check Point Black Basta October 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d10cea20-846f-4c55-9566-cd7367ae6488

Avertium Black Basta June 2022 · Check Point Black Basta October 2022 · Cyble Black Basta May 2022 · Trend Micro Black Basta May 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1529

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d82f1883-45a6-4b1e-ab7c-e5a3342a3cb9

Trend Micro Black Basta May 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8b43377-366c-42c6-a4d2-ddcfd1228bbf

Check Point Black Basta October 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1480.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f537f279-f1e2-4171-b6bb-b02ad620b207

Deep Instinct Black Basta August 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe18ff64-8ea8-4e21-97b5-5c46a57a39d9

Cyble Black Basta May 2022 · Trend Micro Black Basta May 2022 · Minerva Labs Black Basta May 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.