Black Basta Analysis Details IoCs as Alleged Leader Joins EU and INTERPOL Wanted Lists

Mar 9, 2026 · Original article ↗

Summary

Researchers analyzed Black Basta campaign indicators, retaining 15 IP IoCs and identifying 7,560 email-connected domains, 482 flagged malicious. The article also reports alleged leader Oleg Nefedov was added to EU and INTERPOL wanted lists.

Key points

The article reports that the EU added alleged Black Basta leader Oleg Evgenievich Nefedov to its Most Wanted list and INTERPOL issued a Red Notice.
Researchers examined 18 of 27 published network IoCs and retained 15 IP addresses as IoCs.
Sample traffic showed five potential victim IP addresses communicating with those 15 IoCs between December 25, 2025, and January 25, 2026; the article does not establish that these systems were compromised.
Reverse-WHOIS analysis identified 7,560 email-connected domains, with 482 flagged as malicious; the researchers caution that threat classifications may change with further investigation.
The analysis also found 1,572 string-connected domains, four of which were flagged as malicious, and seven IP-connected domains.
WHOIS and DNS analysis of three sampled domains found 418 domain-to-IP resolutions; vulnerableapp[.]com accounted for 301 resolutions through January 18, 2026.
The article describes Black Basta affiliates as using phishing or known-vulnerability exploitation for initial access, followed by data exfiltration and encryption in a double-extortion model.

Article Details

Attack Vectors: Black Basta affiliates reportedly use phishing and exploitation of known vulnerabilities for initial access.
The reported double-extortion model encrypts victim systems and exfiltrates data.
Ransom notes direct victims to contact the group through a .onion URL reachable with the Tor browser.
Defensive Notes: The researchers recommend supplementary investigation to corroborate entities identified as malicious, noting that some may later be deemed harmless.
The analysis retained 15 IP addresses tagged as campaign IoCs, but investigated only three of the 12 domain IoCs after checking their legitimacy and responsiveness.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bevgfijycd[.]net`	Reported as an email-connected domain associated with malware distribution and C&C.
DOMAIN	`bndduftnfteu[.]com`	Reported as an email-connected domain associated with malware distribution and C&C.
DOMAIN	`btpnxlsfdqbhzazyx[.]net`	Reported as an email-connected domain associated with malware distribution and C&C.
DOMAIN	`bwoslmylnsrr[.]biz`	Reported as an email-connected domain associated with malware distribution and C&C.
DOMAIN	`cgbbwfffnvgh[.]com`	Reported as an email-connected domain associated with malware distribution and C&C.
IPV4	`104[.]187[.]107[.]81`	IP address retained as an IoC associated with the analyzed Black Basta campaign.
IPV4	`213[.]47[.]213[.]243`	IP address retained as an IoC associated with the analyzed Black Basta campaign.
IPV4	`76[.]80[.]4[.]222`	IP address retained as an IoC associated with the analyzed Black Basta campaign.
IPV4	`91[.]204[.]248[.]6`	IP address retained as an IoC associated with the analyzed Black Basta campaign.
IPV4	`92[.]97[.]159[.]185`	IP address retained as an IoC associated with the analyzed Black Basta campaign.