The Black Basta ransomware group, linked to the Cardinal cybercrime group (also known as Storm-1811 and UNC4393), is suspected of exploiting a high-severity privilege escalation vulnerability in the Windows Error Reporting Service as a zero-day. This flaw, tracked as CVE-2024-26169 (CVSS score of 7.8/1-), allows attackers to gain SYSTEM-level privileges and was patched by Microsoft in March 2024. Symantec’s analysis suggests the exploit tool was active before the patch, possibly as early as December 2023, indicating zero-day exploitation. Black Basta, known for leveraging initial access through malware like QakBot and DarkGate, has recently used legitimate Microsoft products such as Quick Assist and Teams to impersonate IT personnel and execute attacks. The exploit tool manipulates registry keys to launch a shell with administrative privileges. Despite potential timestamp falsification, the motive appears minimal. Black Basta, with ties to the defunct Conti syndicate, has caused over 500 breaches since April 2022 and extorted over $100 million. The resurgence of ransomware, marked by new variants like DORRA and increased ransom payments, underscores the evolving threat landscape. Applying the latest security updates remains crucial for mitigation. According to Symantec’s protection bulletin, the best course of action to take to defend from exploitation is through VMware Carbon Black products. “The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.”