Black Basta ransomware gang's internal chat logs leak online

HELLFIRE

https://www.bleepingcomputer.com/news/security/black-basta-ransomware-gang-s-internal-chat-logs-leak-online/

An unknown leaker has released what they claim to be an archive of internal Matrix chat logs belonging to the Black Basta ransomware operation. …

Regards

HELLFIRE

https://www.theregister.com/2025/02/21/experts_race_to_extract_intel/ -- Experts race to extract intel from Black Basta internal chat leaks

... A user going by the name "ExploitWhispers" uploaded the chats in the form of a JSON file nearly 50MB in size to Mega, which has since removed the download link. Alas, the cyber threat intelligence (CTI) community flocked to the rare trove of information to glean any and all insights they could. The problem: It's all in Russian, so translating every message and turning that into actionable intel will take some time. The threat intelligence team at PRODAFT said on Thursday that the chats, which were leaked on February 11, followed an internal conflict largely driven by a single figure within the organization. ... "The internal conflict was driven by 'Tramp' (LARVA-18), a known threat actor who operates a spamming network responsible for distributing Qbot. As a key figure within Black Basta, his actions played a major role in the group's instability. ...

Regards

HELLFIRE

https://www.theregister.com/2025/02/25/southern_water_black_basta_leak/ -- Southern Water takes the fifth over alleged $750K Black Basta ransom offer

Southern Water neither confirms nor denies offering Black Basta a $750,000 ransom payment following its ransomware attack in 2024. The Register asked the utility company - which oversees water and wastewater services across the South of England and Isle of Wight - about the alleged ransom offer after it was included in last week's leaked internal Black Basta chats. A Southern Water spokesperson dodged the question: "As soon as we became aware, over a year ago, of an illegal intrusion affecting our IT systems (not affecting our operations or services to customers), we informed all relevant bodies, including NCSC and Defra. We and our advisers worked closely with NCSC throughout the incident." The leaked chats indicate Black Basta demanded $3.5 million from Southern Water following the January 2024 attack. According to the chat logs, the demands were initially ignored by the utility company before being shot down entirely. ... Scouring the chats, it's unclear whether the alleged offer was accepted. The leaked messages appear to only pertain to a chat room populated by Black Basta members. Sometimes, like in the above case, messages between victims and extortionists would be posted to the chat room for discussion, but full chats between Black Basta and victims are not included in the leaked data. ...

Regards