Los Angeles, March 5, 2025 – Black Basta’s fallen empire isn’t dead, it’s morphing into CACTUS. A shocking investigation has linked ex-Black Basta operatives to CACTUS ransomware, showing identical attack strategies, malware deployment methods, and even shared infrastructure.
A chilling cybercrime shift has been uncovered—former Black Basta affiliates have resurfaced under the CACTUS ransomware banner. Researchers have exposed deep ties between the two notorious cyber gangs, revealing shared tactics and tools that indicate a calculated migration of cybercriminals.
According to Trend Micro, both groups use the BackConnect (BC) module—a powerful tool enabling remote control over infected systems. This module was previously weaponized by Black Basta, but now, CACTUS is using it to steal sensitive data, breach networks, and execute cyber extortion.
A cybersecurity analyst John Mitchell said:
We’re witnessing a strategic shift, not a random occurrence. Black Basta members are actively fueling CACTUS.
The CACTUS gang has also adopted Black Basta’s infamous ‘vishing’ and Quick Assist scams, impersonating IT support to deceive victims. This alarming development signals a major ransomware evolution—where cybercriminals don’t retire, they rebrand.
A cybersecurity researcher Emily Carter said:
These attackers are adapting to law enforcement crackdowns by shifting brands, but their methods remain the same—deception, exploitation, and destruction.
CACTUS ransomware has already been detected in major cyber hubs like California, Texas, and New York, targeting corporations and government systems. Security experts warn: this is just the beginning.
Other News At VPNRanks
Hey, wait!
Stay informed on the latest privacy updates, cybersecurity insights, and internet freedom news by following VPNRanks news daily! As your primary resource for critical updates in online security, we ensure you’re always in the know. Make VPNRanks your go-to guide for safeguarding your digital life.