Actor profile· ACT-005
Black Basta
Ransomware-as-a-serviceHealthcare exposureInternal leaksBrand vs operators
A ransomware brand whose internal communications became public, which is rare enough that the corpus files it as its own category — the operation’s own pricing and negotiation practice, readable, at 25-0227.
13
Files naming the group
5
Sectors in the corpus
2
Jurisdictions
2023
Earliest file
Campaign timeline13 files
FEB 2025Not applicable25-0227A floor from a public ledger and a ceiling from an interested party are not the same kind of object. This corpus has not always said which it was holding.FEB 2025Not applicable25-0226The most sensitive coordination in any organisation is the least likely to be typed. The archive is a survivorship sample of itself.FEB 2025Not applicable25-0225An operation that runs on rotas, subscriptions and payment disputes does not require exceptional people. That is what makes it reproducible.FEB 2025Not applicable25-0223Exaggeration implies the figure was a distorted measurement. This suggests it was not a measurement.FEB 2025Not applicable25-0222Applying the rule to a ransomware leader is the case that tests whether it is a rule or a preference. If it only holds for sympathetic subjects it is not a rule.FEB 2025Enterprise staff25-0220The second move works because the first one is real. The employee has a genuine problem, and internal IT has arrived unprompted to solve it.FEB 2025Southern Water25-0216Response cost and extortion demand are different quantities. The phrase “the attack cost £4.5m” invites the error of treating them as one.FEB 2025Multiple, unidentified25-0215If the demand is a function of revenue, the volume figure attached to it is decoration — and the attacker had no incentive to count accurately.FEB 2025Enterprise edge estate25-0212Patch windows are argued about as though the attacker learns of a flaw when the defender does. Here the advisory was not the starting gun.DEC 2024Ascension24-1219The corpus does not record availability harm less because it matters less. It records it less because nothing compels anyone to measure it.MAY 2024Ascension24-0509A hundred and forty hospitals losing their record system is not a proportionate consequence of one download. What sits between is everything it was allowed to reach.MAY 2024Ascension24-0508The fallback held for a month across 140 hospitals — because enough staff had worked that way before. That is a resource with a retirement date.MAR 2023Capita23-0331The alert fired in ten minutes. The device stayed on the network for 58 hours.
© 2026 ForensicPost Media · the desk · newsletter · attribution policyGlossary