Ghost Sec’s joint ransomware operation and evolution of their arsenal
Summary: Cisco Talos observed GhostSec and Stormous running joint double-extortion attacks with the GhostLocker and StormousX ransomware programs against victims in 17 countries, and on Feb. 24, 2024, Stormous announced a new RaaS program called STMX_GhostLocker with paid, free and data-publishing tiers. Talos found GhostLocker 2.0 in the wild on Nov. 15, 2023, encrypting files with a .ghost extension, exfiltrating .doc, .docx, .xls and .xlsx files to a C2 server at 94[.]103[.]91[.]246 in Moscow, and the group's blog displays its largest ransom as $500,000 USD.
Bottom line: A RaaS program with a working affiliate dashboard, a ransomware builder and a $500,000 top-line ransom figure means the tooling that hit ministries and critical infrastructure in Israel is now available to anyone who joins - and GhostSec has said it is already at work on GhostLocker V3.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·