Loading story…
Trend Micro reported that the Kasseika ransomware used a bring-your-own-vulnerable-driver (BYOVD) technique to compromise Windows environments, disable security tools, and encrypt victim files. In the investigated intrusion, the attackers reportedly gained initial access through targeted phishing, then used remote administration tools and PsExec for execution and lateral movement. The malware abused the signed but vulnerable Martini.sys driver from TG Soft’s VirIT Agent System to terminate antivirus and analysis processes, allowing the ransomware to run with reduced interference.
The operation also employed anti-analysis checks, cleared Windows event logs, and deleted shadow copies before encrypting files with ChaCha20 and RSA through CryptoPP. After encryption, Kasseika dropped ransom notes and changed the victim’s desktop wallpaper. Researchers said the malware shares multiple code and behavioral traits with BlackMatter, including ransom note naming conventions and apparent source-code overlap, indicating the operators may have obtained or reused parts of BlackMatter’s codebase.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro analyzed an intrusion in which Kasseika ransomware gained initial access via targeted phishing, used remote administration tools and PsExec for lateral movement and execution, and abused the signed Martini.sys driver to terminate security processes before encrypting systems. The report also noted code and behavioral similarities between Kasseika and BlackMatter, suggesting the operators had access to BlackMatter source code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Basta emerged as a fast-growing ransomware-as-a-service operation that hit organizations across the United States, Canada, the United Kingdom, Australia, and New Zealand, with victims reported in manufacturing, construction, transportation, telecommunications, and pharmaceuticals. The group has been tied to human-operated intrusions that begin with spearphishing emails and password-protected ZIP archives, often delivering **QakBot** through ISO or JavaScript-based loaders that can bypass Windows Mark-of-the-Web protections, including abuse linked to `CVE-2022-44698`. After initial access, the attackers use **SystemBC**, **Cobalt Strike**, and **Mimikatz** for command and control, credential theft, persistence, and lateral movement, including SMB service execution and **PsExec**. Black Basta operators commonly try to disable Windows Defender and EDR tools, exfiltrate data with **Rclone**, delete volume shadow copies, encrypt files with the `.basta` extension, and leave a `readme.txt` ransom note while threatening to publish stolen data on a TOR leak site if payment is not made.
Aug 15, 2026
Security researchers say the **Payouts King** ransomware operation has emerged as a likely successor tied to former **Black Basta** affiliates, with intrusions showing the same social-engineering playbook: spam bombing, phishing or vishing, abuse of **Microsoft Teams**, and use of **Quick Assist** to gain remote access. After entry, the group steals sensitive data and pressures victims through a **Tor**-hosted leak site and ransom communications over **TOX**, with ransom notes such as `readme_locker.txt` used to direct negotiations. The malware uses layered obfuscation and anti-analysis techniques, including encrypted stack-built strings, hashed API resolution, and direct system calls to disable or evade security tools. Researchers said it establishes persistence with scheduled tasks disguised as Mozilla-related jobs, encrypts files with per-file **AES-256-CTR** keys protected by **RSA-4096**, supports partial encryption of large files, and can create backup copies to recover interrupted encryption. It also excludes selected files and directories, renames encrypted files with a hardcoded extension, and performs post-encryption cleanup by deleting shadow copies, emptying the recycle bin, and clearing Windows event logs.
Jun 29, 2026
**Black Basta** ransomware operators have been observed embedding a **Bring Your Own Vulnerable Driver (BYOVD)** component directly inside the ransomware payload, a shift from the more common approach of deploying an external “EDR killer” tool prior to encryption. The technique abuses a legitimate, signed but vulnerable Windows driver to gain **kernel-level** privileges and terminate security tooling (AV/EDR) on the victim host, reducing the chance defenders can stop the attack before encryption begins. Reporting attributes the finding to analysis by **Symantec** (and the **Carbon Black Threat Hunter Team**), which described the embedded-driver approach as a notable evolution in Black Basta tradecraft and consistent with broader ransomware trends toward BYOVD-based defense evasion. One account also links the activity to the **Cardinal** cybercrime group and notes the behavior had not been seen in prior Black Basta campaigns, suggesting either a retooling or a renewed operational tempo that could be adopted by other ransomware families seeking to reliably neutralize endpoint protections.
Jun 29, 2026