In February 2025 the Black Basta chat archive was published. In May 2025 the LockBit affiliate panel was dumped. This corpus has filed thirteen files across the two and this one puts them next to each other.
Where They Diverge
The Divergence Is The Finding
A second sample that confirmed the first would have been more satisfying and much less informative. What two disagreeing samples establish is that no single leak supports a general claim about how ransomware operations work — which is precisely what this desk warned about at 25-0226 before having any way to test it.
The warning was written when there was one source. It now has evidence behind it.
What Survives Both
Two things. First, that the volume and address figures these operations generate are artefacts of their systems rather than measurements of anything — established independently at 25-0215 and 25-0510 by different routes.
Second, that both operations were commercial concerns with staff, tiers, cuts and conversion problems. Neither leak shows anything resembling the adversary of the briefing slide, and the two agree on that despite agreeing on nothing else.
What This Desk Is Not Going To Write
A synthesis. Two operations is not a sample of a market containing dozens, and the two available ones were selected by whoever chose to leak them rather than by anything resembling a sampling frame.
The corpus measured its own selection bias against incident-response data at 25-1225b and found it over-represents the worse outcome on every measure. The same instinct applies here: two leaks are two leaks, and thirteen files built on them are thirteen files that need this one attached.
It compares findings already filed at 25-0211 through 25-0228 and 25-0508 through 25-0525 rather than adding material. All underlying sources are cited in those files; the principal analyses are listed again below. This desk has examined neither leak directly. No general claim about ransomware operations is made or intended. Corrections: corrections@forensicpost.com.