The ‘Groove’ Ransomware Gang Was a Hoax
Summary: A ransomware group called "Groove," announced Aug. 22 on the Russian-language RAMP forum and promoted as an aggressive criminal organization, was a hoax, according to a post on the XSS forum by a user named "Boriselcin" who said he set up a fake gang and that journalists and security firms "ate it up." The group had posted nearly 500,000 Fortinet VPN login credentials in early September, which Fortinet said came from systems that had not implemented a patch issued in May 2019, and its darknet blog disappeared in late October.
Why it matters: Intel 471 said it believes "boriselcin" operated both the Groove blog and the RAMP forum, and that it is skeptical of the hoax claim, assessing the actor's attempt to create a ransomware group may simply not have worked out as planned - a reminder that the identity and nature of any Ransomware-as-a-Service gang is not always clear.
Read the original at Krebs on Security ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026