Black Basta
Ransomware group formed in 2022, linked by researchers to former Conti members.
German police named Russian national Oleg Nefedov on 21 January 2026 as the suspected founder and leader of Black Basta, and he was added to Europol and Interpol wanted lists. The gang's leak site had gone quiet after its internal chats leaked in February 2025.
Last refreshed: 12 October 2026
Who do German police say led Black Basta?
Timeline for Black Basta
Named as Black Basta
Cybersecurity: Threats and Defences: Mentioned in: Ransomware crews' claims fall to 815Mentioned in: Bitdefender: affiliates cross-claim rival victims
Cybersecurity: Threats and DefencesBackground
Black Basta surfaced in April 2022 as a ransomware brand whose affiliates carried out the intrusions. Joint advisory AA24-131A, from the FBI, CISA, HHS and MS-ISAC, counted more than 500 organisations hit worldwide by May 2024, spread across at least 12 of the 16 US critical infrastructure sectors.
Black Basta drew its people partly from Conti. When Conti shut down in 2022, its members scattered into Black Basta, Royal and other brands. A leak of Black Basta's internal chats in February 2025 exposed the operation, and its victim site stopped posting. On 21 January 2026 German investigators identified Oleg Nefedov, a Russian national, as its suspected founder and leader. Europol and Interpol both list him as wanted, and he is believed to be in Russia.
Black Basta's fade fits a ransomware market where affiliates move freely between brands. Bitdefender reported in June 2026 that rival crews were buying access to the same victim from one broker and each claiming it.