Pierluigi Paganini
December 15, 2023
Based on a recent Digital Forensics & Incident Response (DFIR) engagement with a law enforcement agency (LEA) and one of the leading investment organizations in Singapore (and other victims), Resecurity (USA) has uncovered a meaningful link between three major ransomware groups. Resecurity’s HUNTER (HUMINT) unit spotted the BianLian, White Rabbit, and Mario ransomware gangs collaborating in a joint extortion campaign targeting publicly-traded financial services firms.
Resecurity shared a list of IP addresses associated with the simultaneous attack performed by 3 ransomware groups directly related to the ‘password spraying’ attack. The attack leveraged multiple Residential IP Proxies based in the APAC region. The bad actors leveraged Business Email Compromise (BEC) as the vector to deliver their ransom payment demands anonymously by using compromised e-mail accounts which belonged to other organizations to further complicate the investigation.
These cooperative ransom campaigns are rare, but are possibly becoming more common due to the involvement of Initial Access Brokers (IABs) collaborating with multiple groups on the Dark Web. Another factor that may be leading to greater collaboration are law enforcement interventions that create cybercriminal diaspora networks according to cybersecurity researchers. Displaced participants of these threat actor networks may be more willing to collaborate with rivals.
Still, the growing systemic significance of IABs in the cybercriminal underworld has fomented a more fluid threat landscape where ransomware operators move from one group to another in pursuit of the best financial conditions. Thus, the malicious activity of disparate ransomware gangs may overlap due to the interconnection of varied cybercriminal actors and infrastructures. This is why it is critical to share such intelligence for further analysis with the broader cybersecurity community.
On December 18, the Securities and Exchange Commission’s (SEC) new disclosure requirements go into effect and will require public companies to publicly report material cybersecurity incidents within four days of making a determination that an incident is material. Resecurity is expecting major ransomware groups to accelerate cyber attacks against publicly-traded organizations specifically with the spike of activity during holidays season.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ransomware)
