Cops Seek Head of Black Basta

Police raided two suspected members of the notorious Black Basta ransomware group and circulated an international arrest warrant for the Russian national accused of being the founder and ringleader of the operation.

See Also: How Staffing Reductions Increase Ransomware Risk

“Black Basta is one of the most active ransomware groups of recent years,” said German authorities probing the cybercrime operation, together with law enforcement agencies from the Netherlands, Switzerland, Ukraine and the United Kingdom.

The “transnational hacker group,” active from March 2022 through February 2025, amassed more than 600 victims worldwide, mostly in the West, sowing a trail of disruption as it amassed hundreds of millions of dollars’ worth of cryptocurrency in ransom payoffs from victims.

Black Basta counted more than 20 individuals as active members including seven suspects living in Ukraine, said Ukraine Prosecutor General Ruslan Kravchenko on Thursday.

“Each participant had a defined role, ranging from hacking passwords and writing code to negotiating with victims and cashing out illicit proceeds,” he said.

The group targeted critical infrastructure, including healthcare, the U.S. Cybersecurity and Infrastructure Security Agency, said in a November 2024 alert (see: Leaked Chat Logs Reveal Black Basta’s Dark Night of the Soul).

In conjunction with German law enforcement, police in Ukraine searched the homes of two Ukrainians suspected of being part of the criminal operation, in the Ivano-Frankivsk and Lviv regions, seizing computers, mobile phones, bank records, cash and cryptocurrency.

Digital forensic investigators are reviewing the seized devices. Police said their investigation is continuing.

Police last week publicly identified the group’s suspected leader as being Russian national Oleg Evgenievich Nefedov, 35. He remains at large, and has been placed on Interpol’s international most-wanted list.

While Nefedov’s precise whereabouts remain unknown, he’s likely somewhere inside Russia, says law enforcement intelligence agency Europol’s EU Most Wanted site.

As the head of the organization, “he decided who or which organizations would be the targets of attacks, recruited members, assigned them tasks, took part in ransom negotiations, managed the ransom obtained by extortion and used it to pay the members of the group,” said the Bundeskriminalamt or BKA, Germany’s Federal Criminal Police Office.

Police said the two Ukrainian members of the hacking group detained last week specialized in hacking systems and gaining initial access, stealing sensitive data to be held for ransom and infecting endpoints with ransomware, after which other members of the group would attempt to engage the victim in negotiations and pressure them into paying a ransom.

“The attackers performed the functions of so-called hash crackers – individuals who specialize in extracting passwords to accounts from information systems using specialized software,” police said. Investigators found “evidence of illegal activity.”

At the request of German law enforcement, Ukrainian police last August searched the residence of a different suspected member of Black Basta who lived near the country’s second largest city, Kharkiv. They seized evidence and questioned the suspect. “He is suspected of acting as a so-called ‘crypter,’ ensuring that the malware used was not detected by antivirus programs,” German law enforcement said.

Black Basta appeared to be in decline beginning in the summer of 2024 and largely “inactive” by early 2025, owing to internal conflicts, said Swiss threat intelligence firm Prodaft reported in February 2025.

The researchers said the group’s instability was directly driven by Nefedov’s actions. It also tied him to “a spamming network responsible for distributing QBOT,” aka Qakbot, referring to malware that began as a banking Trojan circa-2007, before being adapted to serve other purposes, including as a malware downloader (see: Breach Roundup: US Indicts Qakbot Malware Leader).

Researchers said Black Basta often used spear-phishing attacks to gain initial access to a victim’s system and that in many cases, these attacks attempted to infect an endpoint with Qakbot, in part to serve as a download for the crypto-locking malware (see: Black Basta Leaks Highlight Phishing, Google Takeover Risks).

Leaked Black Basta chat messages first publicly revealed Nefedov’s identity, tying him to such aliases as Trump/Tramp, GG and AA. “The messages indicate Nefedov was an active member in REvil and Conti and is protected by high-ranking Russian political figures and the FSB and GRU agencies,” said a report from Barracuda, referring respectively to Russia’s principal security agency and military intelligence agencies.

Black Basta spun out from the Conti group in April 2022, which crashed and burned following its leadership’s decision to publicly back Russian President Vladimir Putin’s war of conquest against Ukraine earlier that year. Its public support for the invasion lead to ransom payments drying up.

German police have called on the public to share any pertinent intelligence about Nefedov or other suspected members of the group, while noting that they have thoroughly analyzed previous leaks for intelligence. “The Bundeskriminalamt is aware of the ‘Black Basta leaks,’ which went public at the beginning of 2025, as well as the ‘Conti leaks,’ ‘Trickbot leaks’ and ‘Trickleaks’ that all went public at the beginning of 2022. Information relating to this data is not needed,” it said.