What defenders are learning from Black Basta’s leaked chat logs | CyberScoop<\/title> <meta name=\"description\" content=\"The ransomware syndicate\u2019s internal chats exposed a wide swath of the group\u2019s inner workings.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/black-basta-internal-chat-leak\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"What defenders are learning from Black Basta's leaked chat logs\"> <meta property=\"og:description\" content=\"The ransomware syndicate\u2019s internal chats exposed a wide swath of the group\u2019s inner workings.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/black-basta-internal-chat-leak\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2025-02-24T16:45:10+00:00\"> <meta property=\"article:modified_time\" content=\"2025-02-24T16:45:11+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg\"> <meta property=\"og:image:width\" content=\"2190\"> <meta property=\"og:image:height\" content=\"1369\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1739294329g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1739821441g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1740183262g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=9586249c695df0f3b26c\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/83581\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=83581\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fblack-basta-internal-chat-leak%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fblack-basta-internal-chat-leak%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-83581 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/black-basta-internal-chat-leak\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"24.586956521739\">\n<div class=\"single-article__header-content\" readability=\"33.055555555556\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/black-basta-internal-chat-leak\/\"> <span>Ransomware<\/span> <\/a> <\/li>\n<\/ul>\n<p> The ransomware syndicate\u2019s internal chats exposed a wide swath of the group\u2019s inner workings. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/83581\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"400\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs.jpg?resize=640%2C400&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"pegasus\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg 2190w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=300,188 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=768,480 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=1024,640 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=1536,960 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=2048,1280 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=600,375 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=269,168 269w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=539,337 539w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=1080,675 1080w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-2.jpg?resize=1349,843 1349w\" sizes=\"(max-width: 1080px) 100vw, 1080px\"><figcaption> (getty) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"64.137779406376\"><body readability=\"129.79831257533\"><\/p>\n<p>Black Basta\u2019s internal chat logs, which were leaked earlier this month, are providing defenders with actionable intelligence on the ransomware group\u2019s operations, cybercrime experts told CyberScoop. <\/p>\n<p>Researchers sifting through Black Basta\u2019s exposed communications found details about the group\u2019s preferred tools and techniques, including custom malware loaders, indicators of compromise, cryptocurrency wallets and email addresses associated with the syndicate\u2019s affiliates.<\/p>\n<p>Multiple cybercrime experts likened the significance of the leak to a major exposure of the <a href=\"https:\/\/cyberscoop.com\/ransomware-gang-conti-bounced-back\/\">Conti ransomware group\u2019s internal messages<\/a> in 2022. Black Basta, which emerged around the same time that year, is an offshoot of Conti.<\/p>\n<p>\u201cWe see smaller groups leaked all the time, but for the amount of intelligence that we\u2019re going to gather, nothing other than Conti compares to this,\u201d Allan Liska, threat intelligence analyst at Recorded Future, told CyberScoop. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Threat intelligence researchers have loaded the leaked Black Basta messages into generative AI platforms to quickly analyze the data and make it available for hunting activities. Thomas Roccia, a senior security researcher at Microsoft working independently through the data, found nearly 200,000 Russian-language messages spanning a one-year period ending in September 2024.<\/p>\n<p>Roccia <a href=\"https:\/\/infosec.exchange\/@fr0gger\/114040527487168388\">extracted potential indicators of compromise<\/a>, including IP addresses, domains, credentials and file names mentioned in Black Basta affiliate chats. Other researchers compiled information about how the group gained initial access to victim environments and evaded detection.<\/p>\n<p>\u201cDefenders can examine the threat actor\u2019s tactics, techniques and procedures in relation to their threat models,\u201d Halit Alptekin, chief intelligence officer at Prodaft, said in an email. \u201cThis also gives them an opportunity to gain insights into cybercriminal activities from the attacker\u2019s perspective.\u201d<\/p>\n<p>While the most actionable intelligence is likely contained in indicators of compromise found in the chat logs, much of that infrastructure will quickly become obsolete as Black Basta affiliates shut systems down, Alptekin said. <\/p>\n<p>\u201cFrom a threat intelligence and law enforcement perspective, these types of leaks are incredibly valuable. They provide insights into the services the group uses, their tactics, techniques and procedures, internal relationships between threat actors, operational workflows, and communication methods,\u201d Alptekin said. \u201cThis kind of intelligence is crucial for disrupting cybercriminal networks and understanding their evolving strategies.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Black Basta\u2019s inner workings reveal a cybercrime group rife with internal conflicts. Yet, the notorious ransomware-as-a-service group\u2019s affiliates have wreaked havoc on organizations globally.<\/p>\n<p>Over a two-year period, the ransomware variant was used to encrypt and steal data from at least 12 of the 16 critical infrastructure sectors, <a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa24-131a\">impacting more than 500 organizations<\/a>, according to the Cybersecurity and Infrastructure Security Agency. <\/p>\n<p>The group pulled in <a href=\"https:\/\/www.elliptic.co\/blog\/black-basta-ransomware-victims-have-paid-over-100-million\">at least $107 million in ransom payments<\/a> by late 2023, research from Elliptic and Corvus Insurance found.<\/p>\n<p>The Black Basta leak followed a decrease in activities earlier this year, which was caused by key members defecting to other cybercriminal operations, like the Cactus ransomware group, according to Alptekin. \u201cThis exposure has further destabilized the group and impacted trust among its members,\u201d he said.<\/p>\n<p>Rapid7 observed a <a href=\"https:\/\/www.rapid7.com\/blog\/post\/2024\/12\/04\/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware\/\">resurgence of social engineering attacks linked to Black Basta<\/a> operators in early October, but the group has been largely inactive this year. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The intelligence gathered from other ransomware groups\u2019 previously leaked chats, including those associated with Conti\u2019s operations, have exposed information about infrastructure, commands and illicit services used in their operations, according to Genevieve Stark, head of cybercrime analysis at Google Threat Intelligence Group.<\/p>\n<p>\u201cDefenders can then use this information to prioritize their detection and hunting efforts,\u201d Stark said in an email. The messages can also support researchers\u2019 attribution efforts by revealing transaction artifacts, the organization\u2019s hierarchy, relationships between cybercriminals and the roles they serve, she added.<\/p>\n<p>The Conti chat leak \u201crevealed who developed specific malware families, the location of certain threat actors, and information suggesting that the subset of the activity was not financially motivated and could instead reflect a possible association with Russian intelligence apparatus,\u201d Stark said.<\/p>\n<p>Additionally, Black Basta\u2019s internal communications reflect cybercriminals\u2019 tendency to overshare and boast among co-conspirators.<\/p>\n<p>\u201cIf there\u2019s one thing about the ransomware groups, they\u2019re a chatty bunch,\u201d Liska said. \u201cFor being super master criminals, they\u2019re not good at keeping their mouths shut.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.7202505219207\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/black-basta-internal-chat-leak\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What defenders are learning from Black Basta’s leaked chat logs<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[72,912,282,78,3729,46,2015,256],"tags":[73,914,286,86,3731,54,2017,262],"class_list":["post-7389","post","type-post","status-publish","format-standard","hentry","category-black-basta","category-conti","category-cybercrime","category-cybersecurity","category-google-threat-intelligence-group","category-ransomware","category-recorded-future","category-research","tag-black-basta","tag-conti","tag-cybercrime","tag-cybersecurity","tag-google-threat-intelligence-group","tag-ransomware","tag-recorded-future","tag-research"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/black-basta\/\" rel=\"category tag\">Black Basta<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/conti\/\" rel=\"category tag\">Conti<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/google-threat-intelligence-group\/\" rel=\"category tag\">Google Threat Intelligence Group<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/recorded-future\/\" rel=\"category tag\">Recorded Future<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/research\/\" rel=\"category tag\">Research<\/a>","tag_info":"Research","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7389"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7389\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7389,"date":"2025-02-24T10:45:10","date_gmt":"2025-02-24T16:45:10","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=83581"},"modified":"2025-02-24T10:45:10","modified_gmt":"2025-02-24T16:45:10","slug":"what-defenders-are-learning-from-black-bastas-leaked-chat-logs","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/02\/24\/what-defenders-are-learning-from-black-bastas-leaked-chat-logs\/","title":{"rendered":"What defenders are learning from Black Basta\u2019s leaked chat logs"},"content":{"rendered":"