BackConnect, Microsoft Teams, & Social Engineering—How Ransomware is Adapting

The ransomware landscape is shifting, and Black Basta and Cactus are at the center of it. In this episode, we break down the connections between these two ransomware gangs, their shared tactics, and the use of BackConnect malware for stealthy post-exploitation access.We explore how both groups use social engineering via Microsoft Teams—posing as IT help desk personnel—to trick employees into granting them remote access through Windows Quick Assist. With Black Basta reportedly fading and its leak site offline, is Cactus simply a rebranded version of the notorious gang? Or is there a deeper overlap in their membership?We also discuss the role of BackConnect malware in obfuscating attacker movements, how ransomware gangs evolve after law enforcement crackdowns, and why businesses need to rethink their security strategies.Key Takeaways:🔹 How ransomware gangs like Black Basta and Cactus use social engineering to breach corporate networks🔹 The role of BackConnect malware in maintaining stealth and persistence🔹 The possible decline of Black Basta and whether its members have migrated to Cactus🔹 Why ransomware groups rebrand and shift tactics after crackdowns🔹 Actionable security measures to protect against evolving ransomware threatsCyber threats are evolving—stay ahead of them. Tune in now!