Are Former Black Basta Affiliates Automating Executive Targeting?

**Executive summary:** ReliaQuest assesses that former Black Basta affiliates are running a coordinated, automated campaign that combines high-volume email bombing with Teams-based help-desk impersonation to quickly coerce senior executives into initiating RMM sessions (e.g., Supremo, Quick Assist), enabling hands-on access and likely pre-ransomware staging; the activity surged in March 2026, disproportionately targets manufacturing and PSTS sectors, and includes observable IOCs and actionable mitigation guidance.