Black Basta: The revelations about the head of the ransomware group

The background to one of the biggest cybercrime cases

The Black Basta ransomware group has attacked hundreds of companies and authorities worldwide, caused immense financial damage and established itself as one of the most dangerous cybercrime organizations. Recent investigations by SPIEGEL, in which the German Cyber Security Organization (DCSO) played a key role, have uncovered explosive details about the group’s suspected leader.

The escape of a professional criminal

In June 2024, Russian citizen Oleg N. was arrested in Armenia. He was wanted by US authorities for billion-dollar fraud. However, a chain of miscarriages of justice and suspected influence from high-ranking contacts allowed him to escape. Internal chats obtained by SPIEGEL suggest that Oleg N. is identical to “Tramp”, a well-known figure in the cybercrime underground and a leading member of Black Basta. He is said to have close ties to Russian secret services, which may have helped him to escape.

Black Basta: one of the most dangerous cybercrime groups

Black Basta emerged from the disbanded Conti group and has blackmailed more than 700 companies since 2022. The group operates according to the “ransomware as a service” model, in which it passes on malware to partners who then carry out attacks and demand ransoms. Their double-extortion strategy is particularly perfidious: in addition to encrypting data, they threaten to publish it.

International threat and investigations

ZProminent victims of Black Basta include Rheinmetall, Sixt, Medion, ABB and Thales. Security authorities around the world are trying to dismantle the group, but as with Conti, the organization could simply regroup.

The DCSO has been following the activities of Tramp and his group for years. Our experts have insights into his networks and the actions of Black Basta. The latest revelations confirm this: Cybercrime remains one of the biggest challenges for companies and states worldwide.

Read more about this in the (S+) SPIEGEL article: Ransomware-Gruppe Black Basta: Wie ein mutmaßlicher Erpresser aus Russland der Justiz entkam