Unmasking Media-Hungry Ransomware Groups: Bashe (APT73)

This report assesses Bashe (self-styled APT73/eraleign) as a recently active ransomware actor whose public data leak claims across multiple targets are largely fraudulent—reposting or curating old leaks and combolists—while warning that media exposure could nonetheless attract affiliates and increase future operational risk; it includes timelines of alleged leaks, analysis showing reused data, impact assessment, and recommendations to validate claims and improve monitoring.