Black Basta Ransomware Group Affiliates Leveraging Windows Quick Assist for Initial Access

Executive summary: Arctic Wolf is tracking an active Black Basta affiliate campaign (since April 2024) that uses vishing, email-bombing, and Microsoft Teams to trick users into granting remote access via Quick Assist; attackers deploy loaders and RATs (Qakbot, ScreenConnect, NetSupport Manager, Cobalt Strike, SystemBC), perform discovery and lateral movement (PsExec), and deploy Black Basta ransomware — the advisory includes detections and mitigations such as uninstalling Quick Assist and user awareness training.