CISA and FBI Issue Warning After Black Basta Ransomware Breaches Over 500 Organizations Worldwide

Federal agencies sound alarm as ransomware attacks target critical infrastructure sectors and private industry across multiple continents.

In a joint report released today, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) revealed alarming statistics about the widespread impact of Black Basta ransomware, which has successfully breached over 500 organizations globally between April 2022 and May 2024.

Collaborating with the Department of Health and Human Services (HHS) and the Multi-State Information Sharing and Analysis Center (MS-ISAC), the federal agencies disclosed that Black Basta affiliates have not only encrypted data but also pilfered sensitive information from at least 12 out of 16 critical infrastructure sectors.

According to CISA, the targets of Black Basta ransomware span various regions, including North America, Europe, and Australia, with healthcare organizations among the hardest hit.

Originally emerging as a Ransomware-as-a-Service (RaaS) operation in April 2022, Black Basta has swiftly gained notoriety by infiltrating numerous high-profile victims, such as German defense contractor Rheinmetall, Hyundai's European division, and the Toronto Public Library.

The group's modus operandi and level of sophistication have raised concerns among cybersecurity experts, with some speculating that Black Basta may have links to the disbanded Conti cybercrime syndicate or other Russian-speaking threat groups.

Despite federal advisories urging critical infrastructure organizations to bolster their defenses against ransomware attacks, recent incidents, including a suspected ransomware attack on healthcare giant Ascension, underscore the urgent need for heightened vigilance and cybersecurity measures.