Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Prometheus Ransomware Gang: A Group of REvil?

Summary: Unit 42 tracked Prometheus, a ransomware group first observed in February 2021 that uses a customized variant of Thanos ransomware and claims to have breached 30 organizations across government, financial services, manufacturing, logistics, healthcare and other sectors in the United States, United Kingdom and a dozen more countries. The group runs a customer service ticketing system with payment countdown clocks, demands between $6,000 and $100,000 in Monero (doubled if victims miss an average one-week deadline), and claims ties to REvil that Unit 42 says it has found no indication to support.

Key Takeaway: Only four victims have paid so far, and the group's REvil claim may be a borrowed reputation rather than a real affiliation - a reminder that a gang's stated pedigree is not evidence of its capability. The RaaS model that let Prometheus assemble code, infrastructure and network access from outside providers is what lets a new brand stand up a double-extortion operation within months.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related