Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Black Basta ransomware gangs exploit patched Windows flaw to launch zero-day attacks

A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted.".

The Cardinal cybercrime group (also known as UNC4393, or Storm-1811), an affiliate of the notorious Black Basta gang, has been found exploiting a recently-patched Windows vulnerability to deploy the encryptor, while the flaw was still a zero-day.

A report from cybersecurity researchers Symantec changes what was so far known about the vulnerability, as Cardinal used an elevation of privilege vulnerability found in Windows Error Reporting Service. 

The flaw, tracked as CVE-2024-26169, does not yet have a severity score assigned, but we do know that it was patched in mid-March 2024.

Black Basta

When Microsoft first released the fix, Symantec reminds, it said there was no evidence of in-the-wild exploitation. However, after analyzing a tool that was deployed in a recent attack, the security pros determined that it was likely compiled at an earlier date. That means at least one cybercriminal group abused the vulnerability while it was still a zero-day (before a patch was available). 

Symantec did not say who the target of this attack was, but did say that it was unsuccessful. It also said that by looking at the tactics, techniques, and procedures (TTP) of the attack, Cardinal most likely tried to deploy the Black Basta ransomware variant. 

This ransomware variant was created in April 2022, and since then, it grew to become one of the biggest, most dangerous Ransomware-as-a-service (RaaS) operations in existence.

 Last month, a report compiled by the FBI, CISA, the Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) said that Black Basta compromised more than 500 organizations globally through its affiliates. 

Among the victims are organizations in 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector. Some of Black Basta’s victims include Hyundai Europe, Capita, The American Dental Association, Yellow Pages Canada, Dish, and many, many others. 

Black Basta most likely emerged after the downfall of Conti, another major ransomware player until the beginning of the Russian invasion of Ukraine.

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.