Ransom Cartel Ransomware: A Possible Connection With REvil
Summary: Ransom Cartel is a ransomware-as-a-service operation that surfaced in mid-December 2021, performing double extortion attacks and showing technical overlaps with REvil, which disappeared about two months earlier and one month after 14 alleged members were arrested in Russia. Unit 42 assessed that Ransom Cartel operators had access to earlier versions of REvil source code but not the most recent developments, and observed the group breaching organizations in the U.S. and France around January 2022 across education, manufacturing, and utilities and energy.
What you should know: Ransom Cartel gains initial access through compromised RDP, SSH, and VPN credentials bought from initial access brokers, and it threatens to send stolen data to victims' partners, competitors, and the news, not just publish it on a leak site.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·