The Cardinal cybercrime group (also known as UNC4393, or Storm-1811), an affiliate of the notorious Black Basta gang, has been found exploiting a recently-patched Windows vulnerability to deploy the encryptor, while the flaw was still a zero-day.
A report from cybersecurity researchers Symantec changes what was so far known about the vulnerability, as Cardinal used an elevation of privilege vulnerability found in Windows Error Reporting Service.
The flaw, tracked as CVE-2024-26169, does not yet have a severity score assigned, but we do know that it was patched in mid-March 2024.
Black Basta
When Microsoft first released the fix, Symantec reminds, it said there was no evidence of in-the-wild exploitation. However, after analyzing a tool that was deployed in a recent attack, the security pros determined that it was likely compiled at an earlier date. That means at least one cybercriminal group abused the vulnerability while it was still a zero-day (before a patch was available).
Symantec did not say who the target of this attack was, but did say that it was unsuccessful. It also said that by looking at the tactics, techniques, and procedures (TTP) of the attack, Cardinal most likely tried to deploy the Black Basta ransomware variant.
This ransomware variant was created in April 2022, and since then, it grew to become one of the biggest, most dangerous Ransomware-as-a-service (RaaS) operations in existence.
Last month, a report compiled by the FBI, CISA, the Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) said that Black Basta compromised more than 500 organizations globally through its affiliates.
Among the victims are organizations in 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector. Some of Black Basta’s victims include Hyundai Europe, Capita, The American Dental Association, Yellow Pages Canada, Dish, and many, many others.
Black Basta most likely emerged after the downfall of Conti, another major ransomware player until the beginning of the Russian invasion of Ukraine.
