Black Basta threat actors have recently launched a new malicious social engineering campaign targeting United States corporations. Known for their double extortion tactics, Black Basta has been one of the larger threat groups emerging in 2022. Recently, the group was linked to the FIN7 cybercriminal organization after indicators from a previous attack overlapped with known FIN7 infrastructure. In the recent campaign, Black Basta threat actors are utilizing the Qakbot malware as the point-of-compromise in their attacks, capable of moving laterally throughout the victims’ network. Qakbot is a banking trojan used to primarily steal financial data, including but not limited to credential pairs, keystrokes, and browser information. Several scenarios from this campaign have highlighted fast moving attacks, typically gaining access within two (2) to three (3) hours and deploying ransomware payloads in twelve (12) hours and locking out victims from their own network by disabling DNS protocols. After the attack, Black Basta actors will demand a significant ransom from the victim, using the stolen data as leverage in negotiations. Thus far, Black Basta has hit at least ten (10) corporations in this campaign and is likely to continue to in the coming weeks. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.