Attacks deploying the BackConnect malware through similar tactics have been launched by both Black Basta and Cactus ransomware operations, further bolstering the association between both ransomware gangs after recent reports linking Zloader malware, BackConnect payload, and Qbot to Black Basta, as well as the recent Black Basta data leak exposing the group's inner workings, reports BleepingComputer.
After subjecting targets to a deluge of malicious emails, Black Basta and Cactus impersonated IT help desk employees on Microsoft Teams to lure their victims into giving remote access, according to a Trend Micro report, which also found the Cactus attack to involve Black Basta-linked command-and-control servers.
Such findings come two years after the emergence of Cactus ransomware, which was previously reported to have leveraged the TotalExec PowerShell script commonly found in Black Basta intrusions.
Black Basta was also observed to have its activities dwindle since December, prompting suspicion that most of its members may have transferred to Cactus and other ransomware groups.
