Black Basta’s playbook lives on as former affiliates launch fast-scale intrusion campaign

SITREP: Former affiliates of the Black Basta ransomware group have initiated a rapid intrusion campaign targeting numerous organizations since May 2025. This resurgence follows a notable spike in social engineering tactics observed last month. TACTICAL ASSESSMENT: The continuation of Black Basta's tactics by former affiliates indicates a persistent threat in the cyber landscape, potentially complicating defensive measures for organizations. This development suggests that the methodologies of successful cybercriminal groups can be easily adopted by others, perpetuating the cycle of cyber threats. PROJECTED VECTORS: It is likely that the campaign will expand further, potentially leading to increased incidents of data breaches and financial losses for targeted organizations.