Researchers from ReSecurity have discovered a connection between multiple ransomeware gangs. In a recent Digital Forensics & Incident Response with a law enforcement agency, this was discovered.
Resecurity’s spotted the BianLian, White Rabbit, and Mario ransomware gangs collaborating in a joint extortion campaign targeting publicly traded financial services firms.
Resecurity shared a list of IP addresses associated with the simultaneous attack performed by 3 ransomware groups directly related to the ‘password spraying’ attack. The attack leveraged multiple IP Proxies based in the APAC region.
The bad actors leveraged Business Email Compromise as the vector to deliver their ransom payment demands anonymously by using compromised e-mail accounts that belonged to other organizations to further complicate the investigation.
These types of campaigns are rare but are possibly becoming more common due to the involvement of Initial Access Brokers (IABs) collaborating with multiple groups on the Dark Web. Another factor that may be leading to greater collaboration is law enforcement interventions that create cybercriminal diaspora networks.
The inclined use of IABs in the cybercriminal underworld has fomented a more fluid threat landscape where ransomware operators move from one group to another in pursuit of the best financial conditions Thus, the malicious activity of disparate ransomware gangs may overlap due to the interconnection of varied cybercriminal actors and infrastructures. This is why it is critical to share such intelligence for further analysis with the broader cybersecurity community.
