Ransomware crew may have exploited Windows make-me-admin bug as a zero-day

Symantec's threat hunters analyzed an exploit used in a failed Black Basta ransomware attempt and found signs the exploit for CVE-2024-26169 (a Windows Error Reporting privilege escalation) may have been compiled before Microsoft patched it, suggesting possible zero-day use; the activity aligns with tactics attributed to Storm-1811/UNC4393 (Quick Assist abuse and scripted deployment) though Symantec calls the evidence suggestive rather than conclusive.