Black Basta exposed: A look at a cybercrime data leak and a key member, “Tramp”

A Feb. 11, 2025 leak by a Telegram user (ExploitWhispers) exposed about 197,000 Black Basta internal chats from 80 Matrix rooms across six domains, providing insight into the ransomware group’s operations (wallets, domains, IoCs, tools/TTPs) and internal dynamics. Intel471 and LeMagIT link a key member known as Tramp (aka AA/GG) to Oleg Y. Nefedov, recounting his June 2024 arrest in Armenia and subsequent escape amid claims of protection by Russian security services; Black Basta is reported as still active, though diminished and with roots in Conti.