Ransomware: Because OpSec is Hard?
Summary: Cisco Talos linked the destructive ransomware Ranscam to the Jigsaw and AnonPop variants through shared infrastructure, including domains registered to cryptofinancial[@]yandex[.]com and later transferred to minercount[@]yandex[.]com, plus a reused Bitcoin address and matching compiler artifacts. Researchers also found an unreleased Ranscam version uploaded as rs13.zip on July 13, and tied a Reddit user named cryptoconsulate to posts pushing domains that hosted the malware.
Bottom line: A single actor appears responsible for multiple distinct ransomware variants, so the number of variants you see does not equal the number of threat actors you face. The reused Bitcoin address and shared registrant details show an operator whose poor OpSec is the main thing making attribution possible.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026