Black Basta ransomware gang linked to Windows zero-day attacks

Symantec reports that Black Basta (linked to Cardinal/UNC4394) used an exploit for CVE-2024-26169 in the Windows Error Reporting service to elevate to SYSTEM—deploying the tool after initial DarkGate loader infections and abusing the WerFault Debugger registry key—likely having working exploits days to months before Microsoft patched the flaw on March 12, 2024; organizations should apply the Microsoft patch and follow CISA ransomware guidance.