The new “BlackMatter”, “Haron”, and “El_Cometa” ransomware groups, which surfaced in the past three weeks, bear significant similarities to ransomware groups that disappeared last month. In addition, “Babuk” and “Lockbit” have returned to the scene as “2.0” versions of their original groups. Both phenomena point to a rebranding effort of ransomware operators―some claiming significant advancements in capability and technical sophistication. The rebranding trend likely represents the completion of a ransomware development cycle, which is often observed after groups cease attacks, and will probably bring new ransomware operations. In general, an increase in ransomware activity against all sectors and geographies is likely over the short-term future (one to three months), coinciding with the emergence of new (or rebranded) ransomware groups.

×
Want these
Threat Intelligence reports sent straight to your inbox?
Subscribe below!
Thank you!
Error - something went wrong!
Most Recent Flipbooks
Weekly Intelligence Summary 21 October
Main story: Ransom Cartel and REvil: Partners in cybercrime?
Weekly Intelligence Summary 14 Oct
Main story: Hacktivists fan flames of Iranian anti-regime protests
Weekly Intelligence Summary 07 Oct
Main story: ProxyNotShell spells déjà vu for MS Exchange Server defenders
Weekly Intelligence Summary 30 Sept
Main story: Rogue ex-developer leaks LockBit 3.0 builder
Weekly Intelligence Summary 23 Sept
Main story: Uber compromised by Lapsus$'s resurgence
Weekly Intelligence Summary 16 Sept
Main story: Cyber attacks shock the Italian energy sector
Weekly Intelligence Summary 09 Sept
Main story: Back to school for students and ransomware groups