Unmasked by Leaks: The Hidden Backbone of a Ransomware Operation
ID: 66aa7c5e-d894-5d4f-ac43-022e6f4fe7dc
STIX ID: report--66aa7c5e-d894-5d4f-ac43-022e6f4fe7dc
Feed Name: GBHackers
**Executive summary:** In February–March 2025, anonymous leaks released ~200,000 BlackBasta Matrix messages and a Media Land/Yalishanda hosting database that revealed technical operations, server configurations, customer records, cryptocurrency flows, and real names (notably Kirill Zatolokin / "Slim Shady" and Aleksandr Volosovik); the disclosures confirmed Media Land’s role as bulletproof hosting for BlackBasta, enabled OFAC sanctions, and provide actionable intelligence on infrastructure, financial laundering, and intermediary roles that defenders and law enforcement can track and disrupt.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.