Black Basta emerged in 2022 with links to the former Conti operation and became a major double-extortion threat to enterprises and critical infrastructure.

Key facts

• Widely assessed to include former members of the Conti ransomware cartel.
• Uses double extortion, phishing, and access bought from initial access brokers.
• Has targeted healthcare and critical-infrastructure organisations, prompting government advisories.
• Internal chat leaks in 2025 offered rare insight into its operations and targeting.

Why it matters

Black Basta often buys access from brokers trading stolen credentials on the dark web. Detecting those credentials early disrupts the supply chain that feeds the attack.

How DarkThreatX helps

DarkThreatX monitors dark web leak sites, forums and marketplaces for activity and data tied to your organisation, so you can respond before exposure becomes a breach. Run a free dark web scan or explore the platform.