Like whitebox servers, rent-a-crew crime ‘affiliates’ have commoditized ransomware – Source: go.theregister.com

Interview There’s a handful of cybercriminal gangs that Jason Baker, a ransomware negotiator with GuidePoint Security, regularly gets called in to respond to these days, and a year ago only one of these crews — Akira — was on threat hunters’ radars and infecting organizations with the same ferocity as it is today.

“As far as the ones that we’re seeing most often in the last couple of months: Akira remains quite a prolific one,” Baker tells The Register. “Qilin has really taken off this year. Hunters International and RansomHub really took off following the disruption of AlphV and LockBit early last year.”

There’s good news and bad news in this for network defenders. The good news is that law enforcement takedowns are working — at least to some degree. 

“They are shutting the core groups down,” Baker says. “They are revealing intelligence behind how these groups operate, and they are causing at least some degree of pain.”

The bad news: ransomware groups’ affiliates don’t disappear, despite the cops’ efforts to shut down leak sites, disrupt IT infrastructure, and even make arrests.

“A lot of affiliates just find a new home and they continue operating,” Baker says, adding that this speaks to “how commoditized many of these ransomware lockers and core groups fundamentally are. The core skills don’t really change. The affiliates keep their preferred tactics, techniques, and procedures. They’re just using a different encryptor, a different locker for their operations.” 

Cut off one head…

This happened with RansomHub, which quickly became the most active and, by some accounts the “most significant threat” to orgs after it picked up out-of-work Lockbit affiliates as well as those looking for jobs after ALPHV/BlackCat pulled an exit scam last year.

More recently, this appears to be the case with Black Basta, which we know because last month hundreds of its internal messages were leaked by a Telegram user. Around the same time, a relatively unknown ransomware crew, Cactus, became more active on the cybercrime scene.

“Cactus has been around for a while, but they’ve not been particularly prolific,” Baker says. “In the last month, which aligns with when Black Basta went dark, they’ve really had an uptick — we’re looking at 25 to 30 victims within a one week period.”

Also this week: TrendMicro researchers spotted Cactus and Black Basta using the same BlackConnect malware to maintain persistent access to compromised machines.

“I think there’s a moderate degree of confidence that you’ve got at least some former Black Boston affiliates aligning and operating under Cactus,” Baker says. 

In the past it might be easy to say, ‘OK, new ransomware group, who cares?’ Now there’s always that chance that this is not actually a new group, this is either a dedicated splinter or just a realignment of experienced affiliates that is going to cause pain in the near term

It’s also worth noting that BlackConnect has links to Qakbot malware, taken down by the FBI in August 2023 before it reappeared three months later. Plus, Black Basta is one of the crime crews that sprung up after Conti disbanded following a similar internal leak situation in 2022.

This continuous churn of new ransomware groups means that incident responders and ransomware negotiators have to be on alert for previously unknown gangs becoming extremely potent seemingly overnight.

“What we’re used to seeing is new groups either flame out very quickly, or they slowly develop organically,” Baker says. “But over the past year because of these forced realignments we’re seeing more and more cases of groups that we’ve not previously heard of rocket up to being incredibly prolific actors in short periods of time because they’re absorbing these experienced affiliates.”

“Whereas in the past it might be easy to say, ‘OK, new ransomware group, who cares?’ Now there’s always that chance that this is not actually a new group, this is either a dedicated splinter or just a realignment of experienced affiliates that is going to cause pain in the near term.”

When it comes to making the decision to pay the extortionists or not to pay, Baker says he hasn’t seen a major pendulum shift either way. And, he adds, as ransomware negotiators, “our role has never been nor should it ever be to push for payment.” 

This difficult decision is left to the organization’s top executives in consultation with their attorneys and insurance carriers. “And we are there as advisors to execute on what they want to do,” he says. “In some cases, they do opt to make a payment. If that is the case, we work to bring that price down as low as possible to keep as much as we can out of the hands of the adversary.”

• So you paid a ransom demand … and now the decryptor doesn’t work
• Ransomware negotiator weighs in on the extortion payment debate with El Reg
• Toronto Zoo ransomware crooks snatch decades of visitor data
• Up to $75M needed to fix up rural hospital cybersecurity as ransomware gangs keep scratching at the door

Even without negotiators — or with a total ban on ransom payments — companies that are determined to pay, especially well-resourced ones with cash on hand, will find a way to meet the criminals’ demands and unlock their data. “But they’d be doing it from a place where they don’t necessarily understand the adversary,” Baker says.

Organizations are becoming more prepared and more resilient against ransomware, he adds. 

“A year, two years ago it would not be uncommon to have victims come in and say, well, we need to do negotiations because our data is encrypted, and they got our backups or and we don’t have backups,” Baker says.

These days, however, in upwards of 70 percent of the ransomware attacks that GuidePoint responds to, the orgs do have viable backups and are able to recover their data. 

“So now the question of payment becomes not as much about operational viability, continuing operations and generating revenue as much as it is about suppressing the data” and preventing the criminals from leaking sensitive personal and customer information along with corporate secrets and other IP, according to Baker. “And that’s a much tougher call for the organization.” ®