The new “BlackMatter”, “Haron”, and “El_Cometa” ransomware groups, which surfaced in the past three weeks, bear significant similarities to ransomware groups that disappeared last month. In addition, “Babuk” and “Lockbit” have returned to the scene as “2.0” versions of their original groups. Both phenomena point to a rebranding effort of ransomware operators―some claiming significant advancements in capability and technical sophistication. The rebranding trend likely represents the completion of a ransomware development cycle, which is often observed after groups cease attacks, and will probably bring new ransomware operations. In general, an increase in ransomware activity against all sectors and geographies is likely over the short-term future (one to three months), coinciding with the emergence of new (or rebranded) ransomware groups.
Most Recent Flipbooks
Main story: Rogue ex-developer leaks LockBit 3.0 builder
Main story: Uber compromised by Lapsus$'s resurgence
Main story: Cyber attacks shock the Italian energy sector
Main story: Back to school for students and ransomware groups
Main story: LastPass suffers source code data breach
Main story: LockBit under DDoS attack: Entrust strikes back?
Main Story: Cisco defies extortion attempts after network breach
Main story: Cybercriminals scramble for new hiding places after 911 proxy service folds
Main story: Free-to-use Redeemer opens doors for ransomware enthusiasts
Main story: LockBit launches new version, welcomes bug hunters
Main story: Attackers seize Microsoft zero-day for malware dissemination, espionage