chushpan
Professional
- Messages
- 661
- Reaction score
- 449
- Points
- 63
Threat actors deploying the Black Basta and CACTUS ransomware families use the same BackConnect (BC) module to maintain persistent control over infected hosts, suggesting that affiliates previously associated with Black Basta may have migrated to CACTUS.
“Once infiltrated, it provides attackers with a wide range of remote control capabilities, allowing them to execute commands on the infected machine”, Trend Micro said in an analysis published Monday. “This allows them to steal sensitive data such as credentials, financial information, and personal files”.🗞 It’s worth noting that details of the BC module, which the cybersecurity company is tracking as QBACKCONNECT due to matches with the QakBot loader, were first documented in late January 2025 by both Walmart’s cyber intelligence team and Sophos, the latter of which named the cluster STAC5777.
Over the past year, Black Basta attack chains have increasingly used email bombing tactics to trick potential targets into installing Quick Assist after being contacted by a threat agent posing as IT or technical support staff.
