Black Basta Ransomware Group's Internal Chats Leaked Online

On February 11, 2025, a significant leak of internal chat logs from the Black Basta ransomware gang was released, allegedly due to their targeting of Russian banks. The leak, uploaded by a user known as 'ExploitWhispers', comprises over 196,000 messages in Russian, revealing internal conflicts and operational details that have rendered the group largely inactive since early 2025. According to cyber threat intelligence firm PRODAFT, some operators within Black Basta have scammed victims by demanding ransom payments without providing functional decryptors, contributing to the group's instability. A key figure behind these internal issues is 'Tramp' (LARVA-18), whose actions have further exacerbated tensions and led to defections to rival gangs like Cactus Ransomware. This incident echoes previous leaks from other cybercriminal groups, highlighting the fragility of such organizations. The insights gleaned from the leaked chats are expected to be invaluable for cybersecurity professionals monitoring ransomware tactics and strategies.