Loading story…
Black Basta operators were reported expanding their intrusion playbook by using the QakBot trojan for initial access and post-compromise activity, while also exploiting the Windows PrintNightmare flaw to escalate privileges and move deeper into victim environments. The combination linked commodity malware delivery with hands-on ransomware operations, giving the group additional ways to establish persistence, harvest credentials, and prepare networks for encryption.
The activity showed Black Basta adopting a more versatile attack chain rather than relying on a single access method, blending malware-enabled footholds with exploitation of a widely abused Windows vulnerability. For defenders, the reported tradecraft underscored the need to monitor for QakBot-related infections, harden and patch systems exposed to PrintNightmare, and watch for follow-on ransomware behavior after seemingly routine malware compromises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing Black Basta ransomware operators expanding their intrusion toolkit to include the QakBot trojan and exploitation of the PrintNightmare vulnerability. The report indicates an evolution in the group's tactics and attack arsenal.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro detailed the infection routine used by **Black Basta** ransomware, outlining how the group compromises systems, deploys payloads, and executes encryption across victim environments. The report identifies Black Basta as a rapidly emerging ransomware threat and describes a structured intrusion chain designed to move from initial access to widespread impact inside targeted networks. The research highlights operational behaviors associated with the malware’s deployment, including hands-on intrusion activity and techniques intended to accelerate encryption and disrupt recovery. The findings give defenders a clearer view of how Black Basta attacks unfold in practice, helping security teams prioritize detection of early-stage compromise, lateral movement, and ransomware execution tied to the group’s playbook.
Jul 12, 2026
**Black Basta** ransomware operators have been observed embedding a **Bring Your Own Vulnerable Driver (BYOVD)** component directly inside the ransomware payload, a shift from the more common approach of deploying an external “EDR killer” tool prior to encryption. The technique abuses a legitimate, signed but vulnerable Windows driver to gain **kernel-level** privileges and terminate security tooling (AV/EDR) on the victim host, reducing the chance defenders can stop the attack before encryption begins. Reporting attributes the finding to analysis by **Symantec** (and the **Carbon Black Threat Hunter Team**), which described the embedded-driver approach as a notable evolution in Black Basta tradecraft and consistent with broader ransomware trends toward BYOVD-based defense evasion. One account also links the activity to the **Cardinal** cybercrime group and notes the behavior had not been seen in prior Black Basta campaigns, suggesting either a retooling or a renewed operational tempo that could be adopted by other ransomware families seeking to reliably neutralize endpoint protections.
Jun 29, 2026
Kaspersky detailed a BlackCat (`ALPHV`) ransomware intrusion in which attackers gained access with stolen credentials and moved laterally through the victim environment using common post-exploitation tooling, including **Impacket**. The operation followed a familiar double-extortion pattern: the intruders escalated privileges, conducted internal reconnaissance, staged data for exfiltration, and prepared systems for encryption before deploying the BlackCat payload. The incident showed how BlackCat affiliates combined legitimate remote administration activity with widely available offensive tools to blend into normal network traffic and accelerate compromise. The report highlights the group’s continued reliance on credential abuse, lateral movement over Windows administrative protocols, and data theft ahead of ransomware execution, underscoring the risk posed by affiliates that can rapidly turn an initial foothold into enterprise-wide disruption.
Jul 12, 2026