‘Snatch’ Ransom Group Exposes Visitor IP Addresses
Summary: KrebsOnSecurity found that the Snatch ransomware group's darknet victim-shaming site exposes a 'server status' page leaking the true Internet addresses of its visitors, including a server in Yekaterinburg, Russia at 193.108.114[.]41 that hosts several Snatch domains. The leaked data suggests Snatch is among several ransomware groups using paid Google ads to trick people into installing malware disguised as Microsoft Teams, Adobe Reader, Mozilla Thunderbird, and Discord, with more than 1,300 current and former phishing domains registered to the pseudonym Mihail Kolesnikov between 2013 and July 2023.
What you should know: A single pseudonym, Mihail Kolesnikov, is tied to over 1,300 domains used to push infostealers like IcedID and Rilide, and abuse.ch told Spamhaus that criminals may now be selling 'malvertising as a service' on the dark web - meaning the ad your employee clicks to download Teams may be sourced from a vendor whose entire business is phishing domains.
Read the original at Krebs on Security ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·