Attributed indicators from Black Basta cyberattacks have been linked to known infrastructure and tactics, techniques, and procedures (TTPs) of the FIN7 threat organization. Black Basta is a ransomware organization that first emerged in April 2022. Threat actors from Black Basta incorporate double-extortion tactics in their ransomware engagements, first exfiltrating the data from the victim followed by deploying custom ransomware payloads and using the exfiltrated data as leverage in ransom negotiations. FIN7 is a financially motivated cybercriminal group known for their cyber operations attacking the banking, retail, and hospitality industries. Active since 2013, FIN7 has been a major organization within the threat landscape and has been linked to several other threat groups including REvil, DarkMatter, ALPHAV, and potentially Carbanak. In a recent report by SentinelLabs researchers, Black Basta utilizes a defense impairment toolkit that uses the “BIRDDOG” (“SocksBot”) backdoor, which has been used numerous times in FIN7 attacks. Furthermore, the command-and-control (C2) server the malware connects to is hosted by a commonly used FIN7 hosting provider. While this links the groups together, researchers indicate that the relationship resides within the malware development. The developer behind Black Basta’s defense impairment toolkit used the same coding structure and techniques as a Cobalt Strike DNS beacon used in FIN7 operations. CTIX continues to monitor threat actors across the landscape and will provide additional updates accordingly.