Leaked Black Basta Chat Logs Show Banality of Ransomware

Arguments about strategy, including the old chestnut of “quantity versus quality.” Complaints about compensation, and the boss. Earnest discussions about cryptocurrencies. Welcome to the banal world of life inside a ransomware operation, as highlighted by a swath of internal chat logs leaked from the Black Basta ransomware group.

See Also: Live Webinar | Thrive in Chaos: How to Get Your Minimum Viable Company Back Online

Other messages involved co-workers’ perceived failings, including “testing exploits incorrectly” and scanning victims’ networks in a way that appeared to trigger their security defenses. The logs detail attack techniques, brushes with law enforcement, plus strategies for laundering Bitcoin and Tether ransoms, sometimes including moving funds through the compromised accounts of its victims.

“Hello, my name is Eric, I am calling from the Black Basta group regarding the recent cybersecurity incident taking place in your company. Can you connect me with your management?” So reads a corporate customer service veneered message from April 11, 2024.

The corpus of Russian-language messages was leaked on Feb. 11 by Telegram user “ExploitWhispers,” who claimed the dump was in reprisal for the ransomware group targeting Russian banks. Multiple security researchers said the chats appear to be legitimate, based on their correlating with known events and facts.

The approximately 200,000 messages feature 50 different users and run from Sept. 18, 2023, through Sept. 28, 2024, said veteran security researcher Thomas Roccia in a post to social platform Mastodon. Roccia said he used a retrieval-augmented generation framework to make them easier to study.

Threat intelligence firm Hudson Rock loaded the messages into ChatGPT, debuting the BlackBastaGPT chatbot, which can be queried in multiple languages.

“This AI chatbot is for threat intelligence researchers, letting you dive into Black Basta’s internal chats to unpack their ops, tactics, cash flow and humor,” said Alon Gal, co-founder and CTO at Hudson Rock, in a post to LinkedIn. “It’s raw, real and pulls straight from the data.”

When asked for Black Basta’s single largest ransom demand, BlackBastaGPT said it was $28.7 million, tied to 1.5 terabytes of data allegedly being stolen from an unnamed organization, with a “50% discount” offered if payment got sent within 48 hours. “The offer included a decryptor, security report and a guarantee not to attack again,” the chatbot said.

Leaving a 48-hour countdown timer on a victim organization’s systems and offering a 50% discount for payment before that time ran out appears to have been a regular Black Basta tactic. In a negotiation with another victim, according to BlackBastaGPT, Black Basta demanded $1.5 million, the victim counter-offered $100,000 and eventually paid $1 million.

The chat messages highlight internal disagreements, including over whether to use targeted phishing or mass spam campaigns. Other messages involved co-workers’ perceived failings, including sniping over noisy cyberattacks that trip defenses.

This isn’t the first time a ransomware group has suffered an embarrassing leak. In February 2022, just after Russia launched its all-out invasion of Ukraine, a Ukrainian security researcher leaked Conti’s internal communications and source code. They revealed an organization structured and run almost like a normal business, compromising about 100 employees. They also suggested that “Stern,” Conti’s head, enjoyed close ties to Russia’s principal security agency, the Federal Security Service, aka FSB.

Black Basta spun off from the Conti group after Stern’s disastrous decision to publicly back President Vladimir Putin’s war of conquest against Ukraine. Shortly thereafter, victims’ ransom payments to the group dried up.

By November 2023, blockchain analytic firm Elliptic and Corvus Insurance said they’d jointly traced “at least $107 million in Bitcoin ransom payments to the Black Basta ransomware group since early 2022.”

Operation In Decline

Security researchers who follow Black Basta say the group has been in decline since last summer. The group “has been mostly inactive since the start of the year due to internal conflicts,” said Swiss threat intelligence firm Prodaft in a post to social platform X. “Some of its operators scammed victims by collecting ransom payments without providing functional decryptors.”

Prodaft said it’s been charting an exodus of “key members” to other ransomware groups, driven by perceptions that Black Basta’s crypto-locking malware has fallen behind what other “major groups” offer.

While the chat logs offer a “fun read,” they also appear to be based on only a partial scraping of the complete logs and don’t offer any “groundbreaking” new insights into the group, said ransomware-tracking expert Yelisey Bohuslavskiy, partner and chief research officer at threat intelligence firm RedSense.

He said the leader of Black Basta used the alias “Trump,” and his deputy “Bio,” although “the latter got fired due to issues with the Russian police.” In addition, “they both had complicated relationships with the Russian state – this has all been known for years.”

In one of the leaked chat messages, Bio told Trump in June 2024: “This is Bio. I was released. Sorry, I couldn’t even say anything; the raid almost broke all my bones when they stormed in. Luckily, I managed to disconnect from the server in time. I think you understand why I disappeared.”

Other internal communications suggest widespread dissatisfaction with Trump, with one message reading: “He is an idiot, of course.”

Although not mentioned much in the leaks, some of the Black Basta’s best hackers – aka penetration testers or pentesters – have already deserted it for rivals, including Akira, Safepay and Fog, and the group’s “fatigued” leadership appears to be getting ever closer to dissolving, Bohuslavskiy said.

While the operation looks headed for disbanding, it still poses a risk to victims, including due to its increasing “negligence,” including decryptors not always working for ransom-paying victims, he said (see: Ransomware: BlackLock Rises, ‘Fatigued’ Black Basta Declines).

The old “never trust a thief” adage appears to still apply. “Based on the Black Basta chats I would say absolutely do not pay them if you’re a victim, particularly if you’re trying to avoid disclosure,” British cybersecurity expert Kevin Beaumont said in a post to Mastodon. “I’d also say they’re dead men walking in terms of being a ransomware group, they’ll probably try to continue but they are super operationally compromised so I don’t see how that’s sustainable.”