BlackBasta Ransomware Brand Picks Up Where Conti Left Off

This article examines the evolution of the BlackBasta ransomware franchise: how it adapted after Qakbot and Conti takedowns by leveraging alternative botnets (Pikabot), buying access from initial-access brokers, developing custom tools (Cogscan for reconnaissance, Knotrock to execute ransomware), and shifting toward social engineering and vishing; the report raises concerns about increasing sophistication, impact on sectors such as healthcare, and possible (but unconfirmed) liaison with Russian state actors, recommending defenders prioritize credential and endpoint protections and monitoring of open repositories.