Windows vulnerability CVE-2024-26169 exploited by Black Basta ransomware gang

The Black Basta ransomware operation is suspected of exploiting a high-severity Windows privilege escalation vulnerability, tracked as CVE-2024-26169 (CVSS v3.1: 7.8). This flaw in the Windows Error Reporting Service was fixed in the March 2024 Patch Tuesday.

Microsoft has not reported active exploitation reported on the vendor's page

Symantec reports that attackers used an exploit tool to manipulate the Windows file werkernel.sys which utilizes a null security descriptor when creating registry keys. The tool creates a registry key (HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe) and sets the "Debugger" value to a malicious executable, allowing the launch of a shell with SYSTEM privileges.

Attackers are identified cybercrime group (Storm-1811, UNC4394), operators of the Black Basta gang. Black Basta is believed to be linked to the now-defunct Conti cybercrime syndicate.

Users are advised to apply the latest Windows security updates.