Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

The attackers gained initial access through social engineering tactics, including Microsoft Teams impersonation and abuse of Quick Assist for remote access. They exploited OneDriveStandaloneUpdater.exe to side-load malicious DLLs.