Alert: GhostSec and Stormous Launch Joint Ransomware Attacks in Over 15 Countries

The cybercrime team termed GhostSec has been joined to a Golang variant of a ransomware family identified as GhostLocker.

“TheGhostSec and Stormous ransomware groups are jointly conducting double extortion ransomware assaults on several business verticals in many nations,” Cisco Talos researcher Chetan Raghuprasad claimed in a report shared with The Hacker News.

“GhostLocker and Stormous ransomware have began a new ransomware-as-a-service (RaaS) method STMX_GhostLocker, delivering different choices for their affiliates.”

Attacks mounted by the team have focused victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand, and Indonesia.

Some of the most impacted business enterprise verticals consist of technology, instruction, producing, authorities, transportation, power, medicolegal, authentic estate, and telecom.

GhostSec – not to be bewildered with Ghost Security Team (which is also called GhostSec) – is portion of a coalition referred to as The 5 Families, which also contains ThreatSec, Stormous, Blackforums, and SiegedSec.

It was shaped in August 2023 to “establish better unity and connections for anyone in the underground world of the internet, to extend and develop our do the job and functions.”

Late final 12 months, the cybercrime group ventured into ransomware-as-a-provider (RaaS) with GhostLocker, featuring it to other actors for $269.99 per thirty day period. Before long immediately after, the Stormous ransomware team declared that it will use Python-based ransomware in its assaults.

The most current results from Talos demonstrate that the two teams have banded together to not only strike a huge array of sectors, but also unleash an current edition of GhostLocker in November 2023 as very well as start off a new RaaS plan in 2024 identified as STMX_GhostLocker.

“The new application is made up of three types of companies for the affiliate marketers: paid, absolutely free, and a further for the folks without a method who only want to market or publish knowledge on their website (PYV service),” Raghuprasad spelled out.

STMX_GhostLocker, which arrives with its very own leak web site on the dark web, lists no a lot less than 6 victims from India, Uzbekistan, Indonesia, Poland, Thailand, and Argentina.

GhostLocker 2. (aka GhostLocker V2) is prepared in Go and has been advertised as fully successful and presenting fast encryption/decryption capabilities. It also arrives with a revamped ransom note that urges victims to get in touch with them inside of 7 times or risk receiving their stolen details leaked.

The RaaS scheme also allows affiliate marketers to monitor their operations, monitor encryption standing, and payments by means of a web panel. They are also offered with a builder that tends to make it possible to configure the locker payload in accordance to their preferences, which includes the directories to encrypt and the procedures and expert services to be terminated ahead of commencing the encryption method.

After deployed, the ransomware establishes relationship with a command-and-management (C2) panel and proceeds with encryption schedule, but not just before killing the defined processes or products and services and exfiltrating files matching a specific record of extensions.

Talos explained it discovered two new tools likely made use of by GhostSec to compromise legit websites. “1 of them is the ‘GhostSec Deep Scan toolset’ to scan reputable websites recursively, and a further is a hack tool to carry out cross-web-site scripting (XSS) attacks known as “GhostPresser,'” Raghuprasad claimed.

GhostPresser is mainly designed to crack into WordPress websites, letting the risk actors to change internet site configurations, add new plugins and customers, and even set up new themes, demonstrating GhostSec’s motivation to evolving its arsenal.

“The group them selves has claimed they’ve employed it in attacks on victims, but we do not have any way to validate any of individuals statements. This tooling would very likely be applied by the ransomware operators for a wide variety of explanations,” Talos instructed The Hacker Information.

“The deep scan instrument could be leveraged to look for methods into victim networks and the GhostPresser software, in addition to compromising target web sites, could be utilised to stage payloads for distribution, if they failed to want to use actor infrastructure.”

Located this posting appealing? Stick to us on Twitter  and LinkedIn to study more exclusive articles we put up.

Some parts of this article are sourced from:
thehackernews.com