Black Basta Pivots to Cactus Ransomware Group

Trend Micro observed that experienced operators from the Black Basta ransomware group appear to be operating under the Cactus ransomware umbrella, deploying a new persistence malware named BackConnect and leveraging social-engineering (email bombing, Microsoft Teams) and legitimate remote-assistance tools (Windows Quick Assist) to gain access. The report notes ~500 historical Black Basta victims, recent attacks concentrated in North America and Europe across manufacturing, finance, and real estate, and recommends restricting remote-assistance tools, enforcing access controls, and training employees.