Black Basta Ransomware Strikes 500+ Entities Across North America, Europe, and Australia

The advisory summarizes Black Basta ransomware-as-a-service activity since April 2022, noting over 500 targeted organizations across critical infrastructure and private industry; affiliates use phishing and known-vulnerability exploitation to gain initial access, deploy tooling such as Cobalt Strike, Mimikatz, PsExec, and RClone, exfiltrate data for double extortion, and encrypt files with ChaCha20/RSA-4096 after disabling recovery; the report also highlights continued exploitation of Qlik Sense (CVE-2023-48365) by CACTUS and an overall shifting ransomware landscape with rebranding and declines in ransom payments.