Elliptic and Corvus Insurance: the “Black Basta” ransomware group, suspected of being a Conti offshoot, extorted at least $107M in bitcoin since early 2022
A cyber extortion gang suspected of being an offshoot of the notorious Russian Conti group of hackers has raked …
Context & Ripple Effects
Black Basta's reported takings give a monetary scale to a group suspected of emerging from Conti after Conti took its infrastructure offline and its leaders moved toward smaller groups. The case suggests that dismantling or rebranding a major ransomware operation need not end the capabilities or commercial incentives behind it.
Bitcoin-denominated extortion has long been central to cybercrime, from ransom demands aimed at financial-sector targets to large-scale ransomware campaigns. This report ties that established payment model to a suspected successor operation.
First-order effects
- The reported $107M-plus in bitcoin establishes Black Basta as a materially successful extortion operation since early 2022, increasing the urgency for its potential victims and incident-response partners.
- The suspected Conti connection puts renewed attention on personnel, infrastructure, and financial flows that may have persisted after Conti's shutdown.
Second-order effects
- Cyber insurers and corporate security teams have further reason to treat ransomware groups as adaptive networks rather than single brands; a group's apparent closure may shift risk rather than remove it.
- Blockchain-tracing findings can help focus investigations on the wallets and payment pathways associated with Black Basta, while attackers have incentives to further fragment their operations.
Third-order effects
- If major ransomware groups repeatedly re-form under new names, disruption efforts will need to target the surrounding affiliate, access-broker, and payment ecosystem—not only a public-facing brand.
- The pattern points to a more decentralized ransomware market in which attribution and enforcement become harder as operators distribute activity across smaller groups.
The trend: Ransomware is evolving from identifiable gangs into resilient, rebrandable criminal networks that preserve know-how and payment infrastructure after disruption.