Ransomware Groups to Watch: Emerging Threats
Summary: Unit 42 describes four emerging ransomware groups: AvosLocker, first observed July 4, 2021, running a RaaS affiliate program advertised on the Dread forum and demanding $50,000 to $75,000 in Monero across seven victims including law firms, a logistics company and a U.S. city. Hive, operating since June 2021, had published 28 victims on its leak site, while HelloKitty samples dating to October 2020 target ESXi with demands from $950,000 to $10 million, and LockBit 2.0 has compromised 52 organizations across 13 countries since its June 2021 rebrand.
Bottom line: LockBit 2.0's modified desktop wallpaper openly advertises for insiders to sell RDP, VPN and corporate email access in exchange for a cut of paid ransom - a recruitment pitch aimed at your own employees.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026