Black Basta Exploits ScreenConnect Flaws to Expand Access and Stage Ransomware

Threat actors including Black Basta have been actively exploiting recent ConnectWise ScreenConnect vulnerabilities to gain access to victim environments, then using that foothold to deepen control and prepare for follow-on attacks. Trend Micro reported post-compromise reconnaissance against domain controllers, including enumeration of domain computers, trusts, domain controllers, and local administrators, indicating efforts to map enterprise networks and identify privileged access.

Attackers were also observed deploying additional remote management tools to maintain persistence and broaden remote access. In compromised environments, they abused BITSAdmin to download and execute another ScreenConnect client from transfer[.]sh, and in several European targets—mostly in Belgium—they installed trial versions of Atera RMM using msiexec parameters linked to an Outlook email account and account identifiers. Researchers warned that the activity could quickly progress to ransomware deployment, data theft, operational disruption, and financial losses, making immediate patching to the latest ScreenConnect version critical.