Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware

New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks. In January, Zscaler discovered a Zloader malware sample that contained what appeared to be a new DNS tunneling feature. Further research by Walmart indicated that Zloader was dropping a new proxy malware called BackConnect that contained code references to the Qbot (QakBot) malware. BackConnect is malware that acts as a proxy tool for remote access to compromised servers. BackConnect allows cybercriminals to tunnel traffic, obfuscate their activities, and escalate attacks within a victim's environment without being detected. Both Zloader, Qbot, and BackConnect are all believed to be linked to the Black Basta ransomware operation, with members utilizing the malware to breach and spread through corporate networks. These ties are further strengthened by a recent BlackBasta data leak that exposed the operation's internal conversations, including those between the ransomware gang's manager and someone believed to be the developer of Qbot. Black Basta is a ransomware gang that launched in April 2022. It is believed to include members of the Conti Ransomware gang, which shut down in May 2022 after suffering a massive data leak of source code and internal conversations. The ransomware gang has historically used Qakbot to gain initial...