THE RISE & FALL OF BLACK BASTA | Inside the $100 Million Ransomware Empire - The CISO Signal EP 21
It was one of the most feared ransomware gangs in the world.Hundreds of victims. More than $100 million in ransom payments. Hospitals crippled. Businesses brought to their knees.And behind it all was a criminal organization operating with the discipline of a multinational corporation.Black Basta had managers, specialized departments, malware developers, penetration testers, and professional negotiators. Its members worked shifts, outsourced assignments, and received performance-based payments.This wasn't a gang of hackers working out of a basement.It was an organized criminal empire.Emerging from the ashes of the notorious Conti ransomware operation in 2022, Black Basta became one of the world's most dangerous cybercriminal organizations.Its operators infiltrated networks, stole sensitive data, deployed ransomware, and demanded millions from victims.In May 2024, an attack linked to Black Basta devastated Ascension, one of America's largest healthcare systems. Hospitals diverted ambulances, medical records went offline, and doctors and nurses returned to paper documentation.Then something extraordinary happened.On February 11, 2025, nearly 200,000 internal messages from Black Basta's private communications were leaked online.Suddenly, the hunters had become the hunted.Investigators could read the criminals' conversations, examine their operations, identify leaders, and uncover the rivalries threatening to tear the organization apart.For the first time, the inner workings of a modern ransomware empire were exposed in extraordinary detail.In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Carlos Borges, Team Lead of Cybercrime Analysis at Intel 471, to investigate the rise and apparent collapse of Black Basta.Drawing on Intel 471's research into the leaked communications, they explore how the gang built its criminal enterprise, generated extraordinary profits, and ultimately began to unravel.TOGETHER THEY INVESTIGATE:• How Black Basta emerged from the collapse of Conti• How the gang collected more than $100 million in ransom payments• Why ransomware operations resemble multinational businesses• How attackers selected victims and infiltrated networks• How fake IT support, phone calls, and Microsoft Teams became weapons• How the Ascension attack disrupted critical healthcare services• How Qbot and Pikabot malware helped scale attacks• What nearly 200,000 leaked messages revealed about Black Basta's leadership• How internal rivalries and collapsing trust contributed to its apparent downfall• Why dismantling a ransomware gang doesn't necessarily stop its operatorsBlack Basta may have fallen. But the people, tools, and criminal networks behind it haven't necessarily disappeared.And somewhere, the next ransomware empire may already be taking shape.━━━━━━━━━━━━━━━━━━━━🎙 EPISODE SPONSOR | INTEL 471Intel 471 provides cyber threat intelligence that helps organizations anticipate threats from the cybercriminal underground.By tracking threat actors, criminal ecosystems, and evolving attack techniques, Intel 471 helps security teams make informed decisions about the risks facing their organizations.https://intel471.com🎙 GUEST CO-HOST | CARLOS BORGESTeam Lead, Cybercrime Analysis | Intel 471Carlos leads investigations into ransomware groups, underground forums, malware operations, and sophisticated cybercriminal networks. His background spans threat intelligence, threat research, purple team operations, and financial sector security.He joins Jeremy to unpack Intel 471's findings from Black Basta's leaked internal communications.━━━━━━━━━━━━━━━━━━━━🔎 EPISODE TOPICSBlack Basta ransomware | Conti ransomware | Ransomware-as-a-Service (RaaS) | Organized cybercrime | Black Basta chat leaks | Ascension healthcare cyberattack | Social engineering | Vishing | Microsoft Teams phishing | Qbot | Pikabot | Initial access brokers | Cyber threat intelligence | Ransomware economics | Threat actor attribution | CISO leadership━━━━━━━━━━━━━━━━━━━━🧩 THE CISO SIGNAL LINKS▶️ YouTube: @TheCISOSignal💼 LinkedIn: The CISO Signal🌐 https://www.thecisosignal.com━━━━━━━━━━━━━━━━━━━━👥 JOIN THE CONVERSATIONBlack Basta's collapse exposed an uncomfortable reality: even when a ransomware organization disappears, its operators and expertise can survive.What's the greatest challenge in defending against organized ransomware?A) Preventing attackers from gaining initial accessB) Detecting attackers already inside the networkC) Containing the damage before ransomware is deployedLet us know your answer in the comments.#CISOSignal #BlackBasta #Ransomware #Intel471 #Cybercrime #Conti #ThreatIntelligence #Ascension #CyberSecurity #CISO #TrueCybercrime
