INSIDE BASHE: THE INTERVIEW WITH THE RANSOMWARE GROUP KNOWN AS APT73

Summary from the TLDR InfoSec newsletter

Bashe (formerly APT73) is a RaaS group rebranded around a Chinese mythological serpent identity. It operates with a 0.25 BTC affiliate entry fee as both a monetization and anti-infiltration measure, and collaborates with initial access brokers and disgruntled corporate insiders. The group claims full-stack encryption, EDR bypass capabilities, and centralized control over negotiation panels and data publication timers, while excluding healthcare, schools, and CIS countries from targeting. This pattern is consistent with norms in the Russian-speaking ransomware ecosystem. Their deliberate vagueness on technical specifics such as key management architecture, combined with profit-first rhetoric and a shifting geographic focus toward countries with higher payment rates, provides useful threat intelligence for defenders modeling RaaS operator behavior.