Code leaks are causing an influx of new ransomware actors
Summary: Since September 2021, ransomware source code and builders for families including Babuk, Conti, LockBit 3.0 and Chaos have been leaked, sometimes intentionally by affiliates and sometimes through operational error. Cisco Talos reports that these leaks let actors with minimal programming knowledge compile their own variants, and it cites new families such as MortalKombat from the leaked Xorist builder, RA Group using leaked Babuk code, and Yashma strains including ANXZ, Sirattacker and Shadow Men Team.
Why it matters: Actors behind these leaked-code variants are demanding ransoms from USD $3.50 to $4,390 in Bitcoin, against the millions sought by groups like REvil, Conti and BlackCat, which means a large population of low-cost, hard-to-attribute operators is now testing attacks on smaller victims.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·