The Black Basta ransomware group has recently been exposed through a significant leak of internal chat logs, revealing potentially identifying details about its operations and members. The leak, released by an individual using the handle ExploitWhispers, includes nearly 200,000 messages shared on the Matrix platform between September 2023 and September 2024. This breach follows Black Basta’s high-profile extortion incidents since its launch in April 2022, targeting entities like Ascension Health in the U.S. and Capita in the U.K. The leak purportedly stems from Black Basta’s attacks on Russian banks, leading to speculation about the leaker’s motives, whether as a security researcher, disgruntled member, or part of a covert law enforcement operation. The chat logs detail the group’s internal conflicts, with some operators scamming victims by collecting ransoms without providing decryptors, leading to the gang’s reduced activity. The chat logs provide insights into the group’s operations, including task assignments, testing, debugging, and attempts to sell hacking tools like a modified version of Cobalt Strike. They also reveal strategic decisions, such as avoiding attacks on large or financially troubled companies and using a “whitelist” mechanism to exclude certain targets. Additionally, the messages identify key figures within the group, including admins Lapa and Cortes, and the main administrator, YY, with the leader believed to be Oleg Nefedov. Black Basta, a Ransomware-as-a-Service (RaaS) operation, has breached over 500 organizations worldwide, collecting around $100 million in ransom payments from over ninety (90) victims. The group’s affiliations include previous operators of Conti, Ryuk, and TrickBot, with more than a dozen members named and sanctioned by Western law enforcement. The leak mirrors previous incidents, such as the Conti leak by a Ukrainian researcher in response to Conti’s support for Russia’s invasion of Ukraine.