Elizabethan England has nothing on modern-day Russia
Summary: Cisco Talos proposes a new category it calls "privateers" for ransomware groups that benefit from governments turning a blind eye or offering material support without direct control, citing DarkSide and Lockbit as examples. Talos notes DarkSide checks target keyboard configurations to avoid Cyrillic users, Lockbit told Talos it would not target Russia or Russian-allied countries, and no ransomware operator has been detained in any Commonwealth of Independent Countries state as long as they don't target member states.
Key Takeaway: Talos describes privateer groups as operating in the "big game hunting" space and exfiltrating hundreds of gigabytes of information, and states that no ransomware operator has been detained in any CIS country as long as they avoid targeting member states - a protection arrangement that leaves defenders outside those states exposed.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026