Wazawaka Goes Waka Waka
Summary: KrebsOnSecurity reports that Mikhail Pavlovich Matveev, known as Wazawaka, ran the Babuk ransomware affiliate program as Boriselcin and founded the RAMP ransomware forum as Orange, and in January 2022 posted working exploit code for the SonicWall VPN flaw CVE-2021-20028 to Twitter from the account @fuck_maze. Babuk hacked the Washington Metropolitan Police Department around April 27, 2021, demanded $4 million, and leaked 250 gigabytes of MPD data on May 11, 2021, while Wazawaka said LockBit paid him roughly $500,000 in commissions over six months and that he had teamed with DarkSide.
What's compelling: The same actor who leaked 250 gigabytes of DC police data after a $4 million demand was also buying zero-days in corporate VPN products and publishing a working SonicWall exploit to Twitter, and the State Department has offered $5 million for information on DarkSide affiliates.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-20028
- Related
- CVE-2021-20028: Sonic Wall Secure Remote Access (SRA) SQL Injection Vulnerability Known Exploited Vulnerabilities · Mar 28, 2022New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026