Ransomware Gangs and the Name Game Distraction
Summary: Krebs on Security traces how major ransomware groups reinvent themselves under new names rather than disbanding, citing DarkSide's $5 million Colonial Pipeline extortion followed by the emergence of BlackMatter using the same encryption methods, and REvil's Kaseya attack that deployed ransomware to as many as 1,500 organizations with a $70 million universal decryptor demand. The piece links REvil to GandCrab, which claimed over $2 billion in extortion before closing in June 2019, and ties Grief, DoppelPaymer and BitPaymer to the Evil Corp group known as TA505 and Indrik Spider, formed in 2014 by former GameOver Zeus affiliates.
What you should know: Security leaders are often tracking a name, not a crew: the same operators behind a $2 billion extortion run reappear as a new brand, and paying one incarnation can put a victim on the wrong side of OFAC sanctions tied to Evil Corp.
Read the original at Krebs on Security ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026