Ransom Cartel Linked to Russia-Based REvil Ransomware Group

The group guiding the ransomware as a provider (RaaS) team known as Ransom Cartel has been linked with the notorious REvil gang.

The statements come from Palo Alto Networks’ security investigate team Unit 42, which shared a new specialized write-up about Ransom Cartel with Infosecurity over the weekend.

In accordance to the advisory, the REvil ransomware stopped running around two months right before Ransom Cartel made its debut and just one particular month soon after 14 of its alleged members were arrested in Russia. 

“When Ransom Cartel very first appeared, it was unclear no matter whether it was a rebrand of REvil or an unrelated menace actor who reused or mimicked REvil ransomware code,” Unit 42 wrote.

On the other hand, in time, the collection turned clearer, predominantly by way of the tools utilized by equally risk actors.

“While Ransom Cartel employs double extortion and some of the identical [tactics, techniques and procedures] TTPs we often observe throughout ransomware assaults, this form of ransomware employs significantly less common equipment – DonPAPI, for example – that we haven’t observed in any other ransomware assaults.”

Based on their investigation, the security researchers also noticed that the Ransom Cartel operators have entry to the first REvil ransomware source code but probable do not possess the obfuscation engine applied to encrypt strings and disguise API calls.

“We speculate that the operators of Ransom Cartel experienced a relationship with the REvil team at 1 place in advance of commencing their own operation,” the advisory reads.

“Due to the higher-profile nature of some corporations qualified by Ransom Cartel and continuous stream of Ransom Cartel cases determined by Device 42, the operator and/or affiliates at the rear of the ransomware likely will continue to attack and extort corporations,” warned the security industry experts.

To secure their programs from Ransom Cartel attacks, Unit 42 called for organizations to deploy anti-ransomware computer software and to overview the indicators of compromise for the menace, which are readily available in the advisory’s original text.

Its publication comes amidst a definite enhance in ransomware assaults and their monetary affect on firms all over the world, as suggested by a modern report by Acronis.

Some parts of this article are sourced from:
www.infosecurity-journal.com