Black Basta and Cactus attackers gang up on Teams users with new techniques

You certainly remember the Black Basta hacker group exploits. Well, according to a new Zscaler security experts report recorded by Bleeping Computer, they discovered links between the Black Basta and Cactus ransomware gangs, with both groups employing similar social engineering tactics and utilizing the BackConnect proxy malware for post-exploitation access to corporate networks.

In January, Zscaler discovered a Zloader malware sample containing a new DNS tunneling feature. Further investigation by Walmart indicated that Zloader was deploying a new proxy malware called BackConnect, which contained code references to the Qbot (QakBot) malware. BackConnect acts as a proxy tool for remote access to compromised servers, allowing cybercriminals to tunnel traffic, obfuscate their activities, and escalate attacks within a victim’s environment without detection1.

Both Zloader, Qbot, and BackConnect are believed to be linked to the Black Basta ransomware operation, with members utilizing the malware to breach and spread through corporate networks. These ties were further strengthened by a recent Black Basta data leak that exposed internal conversations, including those between the ransomware gang’s manager and an individual believed to be the developer of Qbot1.

In a new report by Trend Micro, researchers found that the Cactus ransomware group is also utilizing BackConnect in attacks, indicating a potential overlap in members between both groups. In the Black Basta and Cactus attacks observed by Trend Micro, threat actors employed the same social engineering tactic of bombarding targets with an overwhelming number of emails. The attackers then contacted the targets through Microsoft Teams, posing as IT help desk employees, and tricked victims into providing remote access via Windows Quick Assist.

Right now, no one knows whether Cactur ransomware is a distinct group or just a branch of Black Basta. Coincidently or not, we also recently reported about a massive botnet attack on Microsoft 365 attacks. We’re going through hard times when cybersecurity is of high-level importance for any organization.