Loading story…
Trend Micro detailed the infection routine used by Black Basta ransomware, outlining how the group compromises systems, deploys payloads, and executes encryption across victim environments. The report identifies Black Basta as a rapidly emerging ransomware threat and describes a structured intrusion chain designed to move from initial access to widespread impact inside targeted networks.
The research highlights operational behaviors associated with the malware’s deployment, including hands-on intrusion activity and techniques intended to accelerate encryption and disrupt recovery. The findings give defenders a clearer view of how Black Basta attacks unfold in practice, helping security teams prioritize detection of early-stage compromise, lateral movement, and ransomware execution tied to the group’s playbook.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro released research examining Black Basta ransomware's infection routine, documenting technical details of how the malware operates. The reference does not provide earlier dated events beyond the publication itself.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Basta operators were reported expanding their intrusion playbook by using the **QakBot** trojan for initial access and post-compromise activity, while also exploiting the Windows **PrintNightmare** flaw to escalate privileges and move deeper into victim environments. The combination linked commodity malware delivery with hands-on ransomware operations, giving the group additional ways to establish persistence, harvest credentials, and prepare networks for encryption. The activity showed Black Basta adopting a more versatile attack chain rather than relying on a single access method, blending malware-enabled footholds with exploitation of a widely abused Windows vulnerability. For defenders, the reported tradecraft underscored the need to monitor for QakBot-related infections, harden and patch systems exposed to `PrintNightmare`, and watch for follow-on ransomware behavior after seemingly routine malware compromises.
Jul 12, 2026
Security researchers say the **Payouts King** ransomware operation has emerged as a likely successor tied to former **Black Basta** affiliates, with intrusions showing the same social-engineering playbook: spam bombing, phishing or vishing, abuse of **Microsoft Teams**, and use of **Quick Assist** to gain remote access. After entry, the group steals sensitive data and pressures victims through a **Tor**-hosted leak site and ransom communications over **TOX**, with ransom notes such as `readme_locker.txt` used to direct negotiations. The malware uses layered obfuscation and anti-analysis techniques, including encrypted stack-built strings, hashed API resolution, and direct system calls to disable or evade security tools. Researchers said it establishes persistence with scheduled tasks disguised as Mozilla-related jobs, encrypts files with per-file **AES-256-CTR** keys protected by **RSA-4096**, supports partial encryption of large files, and can create backup copies to recover interrupted encryption. It also excludes selected files and directories, renames encrypted files with a hardcoded extension, and performs post-encryption cleanup by deleting shadow copies, emptying the recycle bin, and clearing Windows event logs.
Jun 29, 2026
**Black Basta** ransomware operators have been observed embedding a **Bring Your Own Vulnerable Driver (BYOVD)** component directly inside the ransomware payload, a shift from the more common approach of deploying an external “EDR killer” tool prior to encryption. The technique abuses a legitimate, signed but vulnerable Windows driver to gain **kernel-level** privileges and terminate security tooling (AV/EDR) on the victim host, reducing the chance defenders can stop the attack before encryption begins. Reporting attributes the finding to analysis by **Symantec** (and the **Carbon Black Threat Hunter Team**), which described the embedded-driver approach as a notable evolution in Black Basta tradecraft and consistent with broader ransomware trends toward BYOVD-based defense evasion. One account also links the activity to the **Cardinal** cybercrime group and notes the behavior had not been seen in prior Black Basta campaigns, suggesting either a retooling or a renewed operational tempo that could be adopted by other ransomware families seeking to reliably neutralize endpoint protections.
Jun 29, 2026