--- title: "New ransomware gang \"Black Basta\" emerges" description: A new ransomware known as Black Basta has emerged, attacking at least 12 companies within its first three weeks of operation — including the American Dental Association and wind farm operator Deutsche Windtechnik. canonical_url: https://www.acronis.com/en/tru/posts/new-ransomware-gang-black-basta-emerges/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 30 April 2022 # New ransomware gang "Black Basta" emerges A new ransomware known as Black Basta has emerged, attacking at least 12 companies within its first three weeks of operation — including the American Dental Association and wind farm operator Deutsche Windtechnik. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** [Video 1](https://www.youtube.com/watch?v=dlBAYSOGyPg) A new ransomware known as Black Basta has emerged, attacking at least 12 companies within its first three weeks of operation — including the American Dental Association and wind farm operator Deutsche Windtechnik. Black Basta continues the trend of using multi-extortion tactics, in which data is exfiltrated before encryption so that cybercriminals may threaten its release if the ransom is not paid. In one attack, the group has demanded a ransom as high as $2 million. There are similarities between the code and websites used by Black Basta and Conti, leading some researchers to believe that Black Basta may be a rebrand of Conti. This is a common tactic used by threat actors to circumvent law enforcement. Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) safeguards your systems against both previously known and brand-new cyberthreats with its included [Active Protection](https://www.acronis.com/en-us/technology/active-protection/) capabilities, detecting and blocking ransomware based upon the malicious behaviors that it exhibits. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)