Black Basta’s playbook lives on as former affiliates launch fast-scale intrusion campaign

ReliaQuest observed a coordinated Black Basta–style social engineering campaign (dating to at least May 2025) in which former affiliates targeted over 100 employees—primarily senior leaders—across dozens of organizations using email-bombing and Microsoft Teams help-desk impersonation to rapidly gain remote access for potential data theft, extortion, or ransomware; researchers noted use of remote access tooling, sector concentration (manufacturing, professional services, finance/insurance, construction, technology), and released IOCs after a March surge in activity.