Amid an Embarrassment of Riches, Ransom Gangs Increasingly Outsource Their Work
Summary: Krebs on Security reports that ransomware groups are hiring subcontractors on Russian-language cybercrime forums to handle post-exploitation work, with one advertiser, "Dr. Samuil," offering 10-15 audited accesses out of every 100 and requiring experience with Cobalt Strike, ESXi, Active Directory and privilege escalation. Intel 471 CEO Mark Arena said compromised accesses are readily bought, sold and traded underground, and KrebsOnSecurity tied Dr. Samuil to multi-vpn[.]biz, a VPN service for cybercriminals run by a company called Ruskod Networks Solutions.
Bottom line: The source describes a gap of days, weeks or months between initial intrusion and ransomware deployment, and a market where access to your network can be sold to anyone - so the intruder you detect today may not be the one who deploys the ransomware.
Read the original at Krebs on Security ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026