Ransom Cartel Linked to Russia-Based REvil Ransomware Group

The workforce behind the ransomware as a services (RaaS) team regarded as Ransom Cartel has been connected with the infamous REvil gang.

The promises appear from Palo Alto Networks’ security study staff Unit 42, which shared a new technological generate-up about Ransom Cartel with Infosecurity over the weekend.

According to the advisory, the REvil ransomware stopped operating about two months right before Ransom Cartel designed its debut and just a person month just after 14 of its alleged associates have been arrested in Russia. 

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“When Ransom Cartel first appeared, it was unclear irrespective of whether it was a rebrand of REvil or an unrelated menace actor who reused or mimicked REvil ransomware code,” Device 42 wrote.

On the other hand, in time, the selection became clearer, primarily through the tools utilized by both of those threat actors.

“While Ransom Cartel makes use of double extortion and some of the exact same [tactics, techniques and procedures] TTPs we normally notice through ransomware attacks, this form of ransomware uses fewer common instruments – DonPAPI, for illustration – that we have not noticed in any other ransomware attacks.”

Primarily based on their investigation, the security researchers also noticed that the Ransom Cartel operators have access to the unique REvil ransomware supply code but probably do not possess the obfuscation motor utilized to encrypt strings and disguise API calls.

“We speculate that the operators of Ransom Cartel had a relationship with the REvil team at 1 stage prior to starting up their individual operation,” the advisory reads.

“Due to the higher-profile character of some organizations targeted by Ransom Cartel and continual stream of Ransom Cartel scenarios recognized by Device 42, the operator and/or affiliates powering the ransomware most likely will carry on to attack and extort corporations,” warned the security gurus.

To safeguard their devices from Ransom Cartel attacks, Unit 42 referred to as for firms to deploy anti-ransomware application and to evaluate the indicators of compromise for the menace, which are obtainable in the advisory’s unique textual content.

Its publication will come amidst a definite improve in ransomware attacks and their economic effect on companies around the world, as suggested by a new report by Acronis.