Top 10 Notorious Ransomware Gangs of 2023

By employing a multitude of advanced techniques like double extortion along with other illicit tactics, ransomware groups are continually evolving at a rapid pace.

In a double extortion tactic, the threat actors not only encrypt data but also threaten their victims to release their sensitive information or data.

In recent times, it’s been noted by security researchers that they are increasingly targeting high-profile victims to maximize their profits by using the following things:-

Sophisticated malware
Demands larger ransom amounts

Besides this, some groups also collaborate or share their resources, through which they make things more challenging for law enforcement and other security experts to combat their activities effectively.

Types Of Ransomware

Here below, we have mentioned all the types of ransomware used by the threat actors for their illicit goals and purposes:-

Locker Ransomware
Crypto-Ransomware
Scareware
Leakware
Ransomware As a Service (RaaS)

However, two types of ransomware are very popular and used widely by threat actors are:-

Locker ransomware
Crypto ransomware

Ransomware Gangs’ Motivations

Here below we have mentioned all the motivations:-

Financial Gains
Ease of Use
Powerful Monetisation
Evolving Technologies
Politics

10 Notorious Ransomware Gangs of 2023

In this blog, we have covered the top 10 notorious ransomware gangs of 2023, and here below, we have mentioned them:-

LockBit
Alphv/BlackCat
Clop
Royal
BlackByte
Black Basta
Ragnar Locker
Vice Society
Everest
BianLian

Now, let’s discuss the above-mentioned top 10 notorious ransomware gangs of 2023:-

LockBit

LockBit, a notorious ransomware group, emerged in September 2019, employing a global ransomware-as-a-service (RaaS) model.

They target global companies and released versions 2.0 and 3.0 in June 2021 and 2022, respectively, featuring:-

BlackMatter-based encryptors
New payment methods
A bug bounty program

Despite their innovations, a setback occurred when the developer leaked LockBit Black’s builder online, compromising its legitimacy.

Alphv/BlackCat

BlackCat/AlphV, a suspected successor to dissolved ransomware groups, operates in Rust to avoid detection and successfully encrypt victims’ files, and this ransomware group targeted:-

Western Digital
Sun Pharmaceuticals

ALPHV/BlackCat is the first Rust-written ransomware, requiring a specific access token and featuring encrypted configurations, including:-

Services/Processes lists
Whitelisted directories/Files
Stolen credentials

Apart from this, it erases Volume Shadow Copies, exploits privilege escalation, and alters file extensions to “uhwuvzu” using AES and RSA encryption.

Clop

The Clop ransomware emerged in 2019 and used a collaborative ransomware-as-a-service (RaaS) model with sophisticated social engineering tactics. Since then, this stealthy group has managed to extort over $500 million from several companies globally.

The operators of this group target a wide range of entities by exploiting the following things:-

Software vulnerabilities
Phishing

One of their notable attacks is they hacked Accellion’s File Transfer Appliance in 2020, affecting global organizations.

Clop encrypts files with “.clop” extension, denying access and teasing data leaks as proof. The operators of Clop employ double extortion tactics, which is why they threaten their victims to expose or sell their sensitive data along with high cryptocurrency demands, which shows the sharp shift from typical ransomware trends.

Royal

Royal Ransomware emerged in 2022 as a sophisticated threat, ranking among the year’s most terrifying campaigns.

Operating under Dev-0569, they primarily targeted high-profile victims like the following we have mentioned to demand millions:-

Silverstone Circuit
A major US telecom

Unlike typical ransomware, Dev-0569, a private group, directly purchases network access and utilizes double extortion tactics, which distinguishes it from other cybercrime operations.

BlackByte

BlackByte surfaced in July 2021, drawing FBI and USS attention for targeting US critical infrastructure sectors.

Despite a Trustwave decrypter released in October 2021, BlackByte evolved with multiple keys and continued operations, possibly linked to Conti’s rebranding.

It persists in global attacks but steers clear of Russian entities like:-

LockBit
RansomEXX

Black Basta

Black Basta ransomware surfaced in February 2022 with a multitude of unique traits. It erases Volume Shadow Copies, replacing them with a:-

JPG wallpaper
ICO file

Unlike others, it encrypts files indiscriminately but spares critical folders, and using the ChaCha20 algorithm, it encrypts with a hard-coded RSA public key.

Besides this, the file size dictates full or partial encryption, with a .basta extension added.

Ragnar Locker

Since Dec 2019, the Ragnar Locker ransomware and its operators have targeted global infrastructure, hitting the following entities:-

Portuguese carriers
Israeli hospital

Operating on Windows by exploiting Remote Desktop Protocol, the group demanded huge payments using a double extortion strategy.

Not only that, but threat actors also threaten the victims with decryption tools and sensitive data release. While Ragnar Locker ransomware is considered one of the most dangerous, as it has a high threat level due to critical infrastructure attacks.

Vice Society

Vice Society is a Russian-speaking hacking group that emerged in 2021. This threat group specializes in ransomware attacks on the following sectors:-

Healthcare
Education
Manufacturing

They operate independently, and they have hit Europe and the U.S. with a double extortion approach through which they demanded over $1 million during their initial ransom and settled it around $460,000.

It penetrates exploiting the internet-facing apps and compromised credentials. While besides this, using SystemBC, PowerShell Empire, and Cobalt Strike, they move laterally.

Even it also exploits the Windows services, PrintNightmare, and evades detection with disguised malware and process injection.

Everest

Everest has been active since Dec 2020, and it has transitioned from data exfiltration to ransomware and now focuses on Initial Access Broker services.

Its targets span industries, with a focus on the Americas, capital goods, health, and the public sector. This notorious group is known for hitting AT&T and South American government entities, and besides this, it’s been linked to the following ransomware:-

EverBe 2.0
BlackByte

It has been operating discreetly, and till now, it has managed to list nearly 100 organizations on its dark website. Uncommonly, the group acts as an Initial Access Broker, a shift from direct ransomware attacks, which is a rare move in the cybercriminal landscape.

BianLian

BianLian ransomware first emerged in June 2022 and is written in the Go language. However, it exfiltrates the data via:-

RDP
FTP
Rclone
Mega

Primarily it targets the following sectors:-

Financial institutions
Healthcare
Manufacturing
Education
Entertainment
Energy

Initially, they used encryption for ransom, but they later incorporated data exfiltration, threatening disclosure. However, Avast’s decryptor in January 2023 shifted its focus to data theft, terminating file encryption.

BianLian hacks via spearphishing, gaining entry through malicious emails or compromised links. Once in, the malware connects to its command server, downloads tools, and secures a lasting hold on the system.

The post Top 10 Notorious Ransomware Gangs of 2023 appeared first on Cyber Security News.

Fuente: https://cybersecuritynews.com/notorious-ransomware-gangs-2023/

Threat Arena