Ukrainian and German Authorities Target Black Basta Ransomware Operatives Ukrainian and German law enforcement have identified two Ukrainian nationals suspected of working for Black Basta, a Russia-linked ransomware-as-a-service (RaaS) group. The individuals, described as "hash crackers," specialized in breaching protected systems to extract passwords, enabling the group to infiltrate corporate networks, deploy ransomware, and extort victims. Searches of their residences in Ivano-Frankivsk and Lviv led to the seizure of digital storage devices and cryptocurrency assets. The alleged leader of Black Basta, 35-year-old Russian national Oleg Evgenievich Nefedov, has been added to the EU’s Most Wanted list and INTERPOL’s Red Notice. Known by aliases including Tramp, Trump, GG, and AA, Nefedov is accused of overseeing operations, selecting targets, recruiting members, and managing ransom payments. Leaked internal chat logs from early 2024 revealed his role, along with claims of ties to Russian intelligence agencies (FSB and GRU), which allegedly helped him evade justice including after his June 2024 arrest in Armenia, from which he was later released. Black Basta emerged in April 2022, targeting over 500 organizations across North America, Europe, and Australia and amassing hundreds of millions in illicit cryptocurrency payments. The group is linked to the defunct Conti ransomware operation, with Nefedov previously associated with Conti under the alias Tramp. Following Conti’s shutdown in 2022, Black Basta operated independently alongside groups like BlackByte and KaraKurt, while other Conti affiliates dispersed to operations such as BlackCat and Hive. After the leaks exposed its structure, Black Basta went silent in February 2025, taking its data leak site offline. However, cybersecurity firms ReliaQuest and Trend Micro report that former Black Basta affiliates may have migrated to the CACTUS ransomware group, citing a surge in victims listed on CACTUS’s site coinciding with Black Basta’s disappearance. The shift underscores the persistent threat of ransomware actors rebranding and regrouping under new identities.