Black Basta Develops Custom Malware in Wake of Qakbot Takedown

The report describes how the Black Basta ransomware gang (UNC4393) has adapted after the takedown of Qakbot by shifting from commodity tooling and phishing to custom malware and diversified initial-access methods; researchers observed reuse of the SilentNight backdoor via malvertising, new .NET reconnaissance and deployment tools (Cogscan, Knotrock), tunneling (Portyard) and an in-memory dropper (DawnCry) to speed discovery, lateral movement, exfiltration and large-scale encryption for extortion.