In quite a few reports, APT73, which currently also operates under the name Bashe, and was previously known as Eraleig, is described as a group that was built after the collapse of LockBit following Operation Cronos. What is your connection to LockBit?
We do not associate ourselves with other groups. We are a completely separate team, with our own rules and our own partners, and our goal is to make money. We hack companies and demand a ransom in exchange for not publishing the data or selling it. We do not attack CIS countries or China.
It seems that the initial access vector for a large portion of your victims is Infostealer logs. What is your process for collecting Infostealer logs, and what other initial access vectors do you use?
We use all possible attack methods to gain access to a victim's network. This mainly involves exploiting vulnerabilities in companies that do not properly monitor their security.
I looked at the rules of your affiliate program. You offer an 80/20 revenue split and clearly state that you do not sell data, do not negotiate directly, and do not provide affiliates with access to victims' networks. How does the affiliate activity work, and how do you decide who can join and how much they receive?
It is simple. Our main goal is to make money. We welcome everyone who wants to earn money with us and help increase our income. The revenue share percentage varies depending on the affiliate's involvement and skills.
One of the rules listed in your affiliate program is that you prohibit attacks against CIS countries, China, and non-profit organizations. However, your published victim list includes entities such as universities and other non-profit organizations. How do you define a "non-profit organization," and how is this rule actually applied in practice?
We do not attack public hospitals or schools.
Your website has a Bug Bounty program, where you offer rewards of up to $1 million for finding vulnerabilities in your website, your malware, and so on. Has anyone ever reached out to you with findings? Have you ever paid a bounty to anyone?
No vulnerabilities have been found on our website. We are able to infiltrate environments that appear secure, while keeping our own infrastructure protected at the highest level.
Several reports, including CloudSEK's report from January 2025, describe Bashe as a group that is "media-hungry." They claim that you sometimes recycle data from old data leak incidents and present public data as stolen data. What do you have to say about this?
We believe that the media is "Bashe-hungry". We are always ready to provide first-hand evidence of our attacks, and the fact that some of our data may match old leaks only proves the success of our work and the authenticity of the data.
In April 2026, your group claimed responsibility for an attack against Gaza Electricity Distribution Company (gedco.ps). What made this target strategically interesting? And what were the actual results of this attack on the ground?
Nothing unusual. This company simply did not take care of the security of its data, like all our victims, so it got hooked by us. As you can see, our website published approximately 15GB of the company's data.
Based on monitoring your victim list, it appears that your group experienced a very long period of inactivity, roughly from March 2025 until the beginning of 2026. What caused this extended hiatus?
We rebuilt the infrastructure, developed a new network of partners, and gathered forces for new attacks.
Do you use AI tools at any stage of the attack chain?
We do not use AI much. Basically, when we obtain large amounts of data, we can use artificial intelligence to quickly identify the types of data we have. There is a lot of data, and it is very difficult to sort it all manually. As for the hacking process, it is carried out only by real professionals, without artificial intelligence.
Is there anything else you would like to say or share with my followers, 40,000 people?
Check the security level of your passwords. Who knows, maybe you are already on our hook ;(
