Black Basta
Cybercrime Financial Russia Active
Aliases: Storm-1811 · UNC4393
- Mentions
- 1
- First seen
- 27 Oct 2026
- Last seen
- 27 Oct 2026
Origin
Russia — Russia-linked ransomware (Conti splinter)
Profile
Black Basta is linked to external Teams chats used as an entry point for delivering malware within 15 minutes. The attacks appear to occur via external communication channels in Microsoft Teams. No further details on targeted sectors or regions are known from the reporting.
Affected vendors
Microsoft