Researchers Discover Shared Module Between Black Basta and CACTUS Ransomware

Researchers have discovered that threat actors using the Black Basta and CACTUS ransomware families rely on the same BackConnect (BC) module to maintain persistent control over infected hosts. Once infiltrated, this module provides attackers with a wide range of remote control capabilities, allowing them to perform various actions. This tactical similarity suggests that affiliates previously associated with Black Basta may have migrated to CACTUS.