Black Basta Ransomware Uses Phishing Flood to Compromise Orgs

Rapid7 and CISA-observed activity: Black Basta floods victims with legitimate-seeming emails to evade filters, then impersonates an IT help desk to persuade users to install remote management software; attackers use that access to install malware, exfiltrate data, and encrypt systems—defenses recommended include user training, reporting mass-email incidents, and blocking unauthorized remote management services.