A new ransomware gang dubbed “Black Basta” has sprung into action, infecting twelve (12) companies just in April 2022. Amassing such a high victim count in a matter of weeks without recruiting affiliates on underground forums has led researchers to believe this is likely a rebrand of an existing ransomware organization. Security researcher MalwareHunterTeam has speculated Black Basta may be an offshoot of Conti, due to the similar appearance of the leak and payment site as well as the personalities of the support representatives. Conti’s rebranding would also make sense as they have been under scrutiny for their announcements made favoring Russia in the current conflict and the Conti Leak incident. Black Basta is using traditional “double-extortion” techniques, where the ransomware steals sensitive data before encryption to later extort the victim. The ransomware used by Black Basta requires administrator privileges to run. Using the privileges, it then performs advanced malware capabilities such as deleting Volume Shadow Copies, hijacking Windows services, then restarting the machine into Safe Mode with Networking. Once it has rebooted, the ransomware will begin encrypting files with the ChaCha20 encryption algorithm and append the “.basta” extension. Finally, the malware changes the wallpaper as well as the “.basta” ICO file and drops a ransom note pointing to their chat website through TOR. The Black Basta chat gives an organization seven (7) days to initiate a negotiation on the price of the ransom. While final ransom payments range in price, one (1) organization stated they received a $2 million-dollar initial demand from the threat actor. CTIX analysts are monitoring the Black Basta ransomware gang and will provide updates on new information released about the group.