BleepingComputer reports that a cybercriminal gang is sending phony ransomware threats to prior victims of ransomware attacks. The gang, which calls itself “Midnight,” claims to have stolen hundreds of gigabytes of data and threatens to leak it if the victim doesn’t pay a ransom.
Security firm Kroll said the gang’s ransom notes use the names of more prolific ransomware actors. Additionally, analysts from incident response firm Arete suspect that the gang is using data that’s already been leaked from the victims in previous ransomware incidents in an attempt to lend legitimacy to their claims.
“Based on their visibility, though, the incident responders observed that Midnight targeted organizations that had previously been victims of a ransomware attack,” BleepingComputer says. “According to Arete’s analysts, among the initial attackers are QuantumLocker (currently rebranded as DagonLocker), Black Basta, and Luna Moth. Arete says that at least 15 of their current and previous clients received fake threats from the Midnight Group, which supported their data theft claims with vague details. It is unclear how victims are selected but one possibility is from publicly available sources, such as the initial attacker’s data leak site, social media, news reports, or company disclosures.”
The group may also be working with the original attackers to gain access to non-public data.
“Arete notes that the fake attacker identified some ransomware victims even when the info was not publicly available, possibly indicating collaboration with the initial intruders,” BleepingComputer writes. “Ransomware actors often sell the data they steal from victims even when they get paid. If Midnight Group has access to the markets and forums where this data is traded or sold they could learn about ransomware victims that have yet to disclose the cyberattack.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for social engineering attacks.
BleepingComputer has the story.
