Ransomware Group ‘Black Basta’ Linked to Zero-Day Attacks on Windows

A zero-day vulnerability in Windows has recently come to light, targeted by the notorious Black Basta ransomware group. This vulnerability, identified as CVE-2024-26169, was exploited by attackers to escalate privileges on compromised systems before Microsoft could release a patch. 

Understanding the Zero-Day Flaw and its Exploitation

The vulnerability affects the Windows Error Reporting Service and poses a significant threat with a severity rating of 7.8. It allows malicious actors to gain SYSTEM privileges, providing them with comprehensive control over the affected system. 

Researchers have found that the Black Basta #ransomware group exploited a recently patched Windows vulnerability (CVE-2024-26169) in the Error Reporting Service as a zero-day.#CyberAwareness

— RSK Cyber Security (@RSKCyberSec) June 13, 2024

Microsoft responded to this critical issue on March 12, 2024, with an update as part of their Patch Tuesday initiative. Despite no immediate reports of active exploitation at the time of the update, subsequent insights from cybersecurity experts indicated that the flaw was indeed exploited as a zero-day.

How Black Basta Exploited the Vulnerability

Symantec’s investigation uncovered an attempted ransomware attack that used an exploit tool for CVE-2024-26169 after an initial infection by the DarkGate loader, a method favored by Black Basta post the QakBot takedown.

The attackers then deployed batch scripts disguised as software updates,  a technique frequently used by Black Basta. These scripts execute malicious commands and establish persistence on the targeted systems.

The exploit tool specifically took advantage of a vulnerability in how the werkernel.sys file manages security descriptors, allowing unauthorized changes to the system’s registry. 

By creating a registry key at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe and altering the “Debugger” value to its own executable, the tool allowed attackers to launch a shell with SYSTEM privileges, granting them full control over the system.

The timestamps on the exploit tool variants – one dated February 27, 2024, and another even earlier, December 18, 2023 – suggest that the exploit was prepared and potentially used up to 85 days before Microsoft patched the vulnerability.

How to Stay Safe

Keeping your system safe from the tactics of groups such as Black Basta requires prompt action. The most effective step is to install the latest security updates from Windows as soon as they become available. Plus, following CISA’s guidelines can help you strengthen your defenses and ensure your system is less vulnerable to such advanced threats.

Other Reads:

• Apple Launches ‘Apple Intelligence’ Feature: A Leap Into Generative AI
• Microsoft and Google Warn of Cyber Threats at 2024 Paris Olympics