Cybercriminals Exploit Windows Zero-Day: Black Basta’s New Weapon Revealed
The Cardinal cybercrime group, an affiliate of Black Basta, exploited a zero-day Windows vulnerability to deploy ransomware. Symantec discovered this elevation of privilege flaw, CVE-2024-26169, which Microsoft patched in March. Despite the fix, Cardinal managed to use the vulnerability before it was patched, targeting organizations worldwide.
Hot Take:
It looks like the Cardinal cybercrime group is trying to become the valedictorian of cybervillains by exploiting vulnerabilities faster than Microsoft can patch them. And just like a bad sequel, they’re bringing back Black Basta for another round of ransomware mayhem!
Key Points:
- Cardinal cybercrime group exploited a Windows zero-day vulnerability to deploy Black Basta ransomware.
- The flaw, CVE-2024-26169, involved the Windows Error Reporting Service and was patched in mid-March 2024.
- The attack was unsuccessful, but it highlights the persistent risks of zero-day vulnerabilities.
- Black Basta ransomware has compromised over 500 organizations globally since its creation in April 2022.
- Victims include major organizations like Hyundai Europe, Capita, and the American Dental Association.
Already a member? Log in here