Security researchers from Unit 42 details a new ransomware-as-a-service group with a multi-extortion operation that’s actively recruiting new affiliates.
The RaaS group dubbed as Repellent Scorpius first emerged in May and distributed Cicada3301 ransomware. It’s written in the Rust programming language and named after the Cicada puzzle, a complex, cyber-related problem-solving puzzle.
The Unit 42 researchers shared the technical aspects of the ransomware TTP’s used by the group. Repellent Scorpius uses a double-tap attack, one where data is encrypted and stolen. That allows the group to extort victims not only by offering a decryption key but also with the threat that the stolen data will be published if the ransom is not paid.
As per the report the Repellent Scorpius’s activities were pre-date to the emergence of Cicada3301. While Cicada3301 first emerged in the last month or two, Unit 42 estimates that Repellent Scorpius first began their operations in May, with leak site activity first observed in June.
The research also found that the group had data obtained in older compromise incidents, noting that it’s unclear if this means the threat actors have previously operated using differently branded ransomware or if they had inherited data from other ransomware groups.
The report doesn’t draw any further links between BlackCat and Repellent Scorpius, but it’s perhaps more than coincidence that the groups have shared an IP address in attacks, given the previous report pointing to Cicada3301 possibly having links to BlackCat.
It’s possible that those behind Repellent Scorpius were previously involved with or linked to BlackCat, Researchers believe that there will likely be an increase in future attacks from the group, since it’s actively recruiting affiliates and initial access brokers.
For more details, here is the link from the actual report
Indicators of Compromise
- 8ec114b29c7f2406809337b6c68ab30b0b7f0d1647829d56125e84662b84ea74
- 0260258f6f083aff71c7549a6364cb05d54dd27f40ca1145e064353dd2a9e983
- 2d73b3aefcfbb47c1a187ddee7a48a21af7c85eb49cbdcb665db07375e36dc33
- 3969e1a88a063155a6f61b0ca1ac33114c1a39151f3c7dd019084abd30553eab
- 56e1d092c07322d9dad7d85d773953573cc3294b9e428b3bbbaf935ca4d2f7e7
- 103.42.240[.]37
- 91.238.181[.]238
- cicadabv7vicyvgz5khl7v2x5yygcgow7ryy6yppwmxii4eoobdaztqd[.]onion/
