Leaked Chats Show Black Basta Priced Demands off Commercial Revenue Data

Analyses of the leaked archive report that Black Basta operators looked up victims’ notional revenue on a commercial business-information service and set demands as a proportion of it. The ransom was priced off the victim’s ability to pay, not off what was taken.

If the demand is a function of revenue, the volume figure attached to it is decoration. The 159GB at 25-1111, the 343GB at 25-1001 — this corpus recorded both as claims because they came from attackers. The leak suggests a further reason for caution: the attacker had no pricing incentive to count accurately.

That is an inference about one group over roughly one year, and it is why this file is graded medium rather than high. It is not a general law of ransomware pricing.

A 50% reduction for paying inside 48 hours is not a negotiation, it is a sales technique. It prices urgency, and it works on a victim whose board is meeting on Monday.

The undertaking not to attack again is the same shape. It has no enforcement mechanism and no value, and it is offered because it makes payment easier to justify internally.

This corpus argued at 25-0613b that every filter selecting incidents into the public record selects for large organisations. Revenue-indexed pricing means the attacker was applying the same filter for a different reason: a bigger notional revenue produces a bigger demand.

Where a commercial data service is the input, the accuracy of that service becomes an operational variable in somebody’s ransom. This desk notes that and declines to develop it, because nothing published establishes how often the figure was wrong.