Ukrainian and German authorities have identified two Ukrainians linked to the ransomware group Black Basta, a service operating under the Russia-linked ransomware-as-a-service model. The group's leader, Oleg Evgenievich Nefedov, a 35-year-old Russian national, has been added to the European Union's Most Wanted list and INTERPOL’s Red Notice. The suspects allegedly specialized in hacking protected systems and extracting passwords, which facilitated their ransomware attacks on corporate networks. Black Basta emerged in April 2022, targeting over 500 companies in North America, Europe, and Australia, amassing hundreds of millions in cryptocurrency. Leaked internal chat logs revealed Nefedov's role as the ringleader and his connections to Russian politicians and intelligence agencies. He has various aliases, including Tramp and Trump. Despite being arrested in June 2024, he managed to evade long-term consequences and is believed to be in an undisclosed location in Russia. The recent report from Analyst1 highlights Black Basta's reliance on Media Land, a bulletproof hosting service sanctioned by multiple countries. Nefedov oversaw target selection, recruitment, and ransom negotiations. Although Black Basta has not been active since February 2025, ransomware groups often rebrand and reform, leading to speculation about the former members' possible involvement in the CACTUS ransomware operation. Reports suggest a substantial increase in activity from CACTUS coinciding with Black Basta's disappearance.