Black Basta ransomware gangs exploit patched Windows flaw to launch zero-day attacks
Cardinal abused an elevation of privilege vulnerability
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The Cardinal cybercrime group (also known as UNC4393, or Storm-1811), an affiliate of the notorious Black Basta gang, has been found exploiting a recently-patched Windows vulnerability to deploy the encryptor, while the flaw was still a zero-day.
Areportfrom cybersecurity researchers Symantec changes what was so far known about the vulnerability, as Cardinal used an elevation of privilege vulnerability found in Windows Error Reporting Service.
The flaw, tracked as CVE-2024-26169, does not yet have a severity score assigned, but we do know that it was patched in mid-March 2024.
Black Basta
WhenMicrosoftfirst released the fix, Symantec reminds, it said there was no evidence of in-the-wild exploitation. However, after analyzing a tool that was deployed in a recent attack, the security pros determined that it was likely compiled at an earlier date. That means at least one cybercriminal group abused the vulnerability while it was still a zero-day (before a patch was available).
Symantec did not say who the target of this attack was, but did say that it was unsuccessful. It also said that by looking at the tactics, techniques, and procedures (TTP) of the attack, Cardinal most likely tried to deploy the Black Bastaransomwarevariant.
This ransomware variant was created in April 2022, and since then, it grew to become one of the biggest, most dangerous Ransomware-as-a-service (RaaS) operations in existence.
Last month, a report compiled by the FBI, CISA, the Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) said thatBlack Basta compromised more than 500 organizations globallythrough its affiliates.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Among the victims are organizations in 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector. Some of Black Basta’s victims include Hyundai Europe, Capita, The American Dental Association, Yellow Pages Canada, Dish, and many, many others.
Black Basta most likely emerged after the downfall of Conti, another major ransomware player until the beginning of the Russian invasion of Ukraine.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Rising AI threats are making firms turn back to human intelligence
Thousands of employees could be falling victim to obvious phishing scams every month
Intel Battlemage rumored for December – could new budget GPUs win over gamers neglected by Nvidia and save the Arc brand?
