A leak of 190,000 chat messages traded among members of the Black Basta ransomware group shows that it’s a highly structured and mostly efficient organization staffed by personnel with expertise in various specialities, including exploit development, infrastructure optimization, social engineering, and more.

The trove of records was first posted to file-sharing site MEGA. The messages, which were sent from September 2023 to September 2024, were later posted to Telegram in February 2025. ExploitWhispers, the online persona who took credit for the leak, also provided commentary and context for understanding the communications. The identity of the person or persons behind ExploitWhispers remains unknown. Last month’s leak coincided with the unexplained outage of the Black Basta site on the dark web, which has remained down ever since.

“We need to exploit as soon as possible”

Researchers from security firm Trustwave’s SpiderLabs pored through the messages, which were written in Russian, and published a brief blog summary and a more detailed review of the messages on Tuesday.

“The dataset sheds light on Black Basta’s internal workflows, decision-making processes, and team dynamics, offering an unfiltered perspective on how one of the most active ransomware groups operates behind the scenes, drawing parallels to the infamous Conti leaks,” the researchers wrote. They were referring to a separate leak of ransomware group Conti that exposed workers grumbling about low pay, long hours, and grievances about support from leaders for their support of Russia in its invasion of Ukraine. “While the immediate impact of the leak remains uncertain, the exposure of Black Basta’s inner workings represents a rare opportunity for cybersecurity professionals to adapt and respond.”

Some of the TTPs—short for tactics, techniques, and procedures—Black Basta employed were directed at methods for social engineering employees working for prospective victims by posing as IT administrators attempting to troubleshoot problems or respond to fake breaches.