Yanluowang Ransomware’s Russian Links Laid Bare

The internal workings of nonetheless a different ransomware team have been laid bare following inner messages had been leaked on line, suggesting the Yanluowang group was truly operate by Russian speakers.

Danger intelligence business Trellix analyzed shut to 3000 messages shared by Twitter consumer @yanluowangleaks, revealing some attention-grabbing tidbits.

The group, which was liable for breaching massive-identify businesses over the previous year which include Walmart and Cisco, converses in Russian, despite its Chinese mythological moniker.

In point, at a single point it wished to post a message in assistance of Ukraine on its ransom web site to enhance the odds of payment, but made a decision not to out of fears it would blow the Chinese include tale, Trellix said.

Like Conti, one more team whose chats were being doxed, Yanluowang appears to have been perfectly organized operationally.

Customers incorporate chief and payroll supervisor “Saint,” guide developer Killanas (aka “coder0”) and pen-testers “Felix” and “Shoker.”

A doxed picture of Killanas appears to demonstrate him putting on a Russian army uniform, which would increase body weight to the principle that the ransomware actors have shut ties to the Kremlin.

The Trellix examination also exposed collaboration concerning the team and other ransomware actors, most notably HelloKitty.

A member of the latter group known as “Guki” joins the chat at some point with a perspective to working with each other, professing to have obtained “dozens” of companies but not to have the in-house staff members to start attacks.

There are also ties to the Babuk gang which give up the ransomware sport last year.

“It would seem that in advance of Yanluowang produced their very own Linux/Unix ransomware locker, they made use of a Linux locker from Babuk ransomware gang,” Trellix defined.

“In a conversation amongst Saint and Guki, Saint implies that Babuk died mainly because of the hacker Wazawaka’s (aka Boriselcin) return, and that Saint himself shed a few of thousands and thousands dollars thanks to Babuk locker not decrypting the data files as it should.”

Curiously, Guki appears to have been concerned about his name appearing in the Conti leaks and on US govt desired lists, indicating a achievable crossover there as well.

Even further, in March 2022, Saint requested Killanas for his Bitcoin wallet.

“We have investigated the wallet and tracked the similar transactions and managed to obtain a achievable backlink to Conti ransomware BTC wallets,” Trellix concluded.

Some pieces of this article are sourced from:
www.infosecurity-journal.com