Inside the Leaks that Exposed the Hidden Infrastructure Behind a Ransomware Operation
ID: fa310e92-582d-555b-97fa-eb929ad138f6
STIX ID: report--fa310e92-582d-555b-97fa-eb929ad138f6
Feed Name: cybersecurityNews.com
Threat Score
In Feb–Mar 2025 leaks revealed ~200,000 BlackBasta messages and a Media Land (Yalishanda) database tying the ransomware group to a bulletproof hosting provider that supplied ~200 servers (17–20 Gbps, plans to expand), customer support, and takedown protection; exposed real identities (including Kirill Zatolokin/Slim Shady) and infrastructure led to international sanctions against the provider and its director.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.