Since the beginning of 2024, a wave of new ransomware groups has emerged, driven by the lure of financial gain, according to a recent report by cybersecurity firm Rapid7. These 21 new or rebranded groups, including names like Space Bears, Rabbit Hole, and FSociety, have joined the ranks of seasoned gangs such as LockBit, which continues to operate despite law enforcement efforts like Operation Cronos.
In the first half of 2024, Rapid7 observed a total of 68 distinct ransomware groups actively posting ransomed data to their individual leak sites, marking a significant uptick in ransomware operations. Raj Samani, Chief Scientist at Rapid7, noted that these groups are innovating with new code bases and features, and are increasingly exploiting zero-day vulnerabilities at scale. This shift represents a fluid and evolving ransomware marketplace.
One of the new groups, FSociety, surfaced in April with its ransomware strain called FLocker. FSociety has been particularly aggressive, targeting sectors like healthcare and medical services. The group operates its leak site on Tor and remains active on its own Telegram channel, demonstrating a growing trend among ransomware operators to leak data as a means of extortion.
Ransomware Family Connections and Disputes
Rapid7's report also touches on the relationships between ransomware families. Contrary to some reports, Rapid7 disputes a direct link between the well-known ALPHV (BlackCat) group and RansomHub, citing differences in the programming languages used (Rust for ALPHV and GoLang for RansomHub). However, they did find connections between other ransomware families, such as Pay and Morok, indicating that while some groups may share techniques or infrastructure, others remain distinct in their operations.
The report also notes that the number of unique ransomware families observed in public incidents has decreased since 2022. This suggests a move towards more specialized and highly effective ransomware variants, focusing on sophisticated extortion operations rather than a broad array of less effective malware.
Small Companies at Greater Risk
Interestingly, Rapid7’s analysis reveals that smaller companies, particularly those with revenues around $5 million, are being disproportionately targeted by ransomware groups. These companies appear twice as often as those in the $30-50 million range and five times more frequently than those with $100 million in revenue. The perceived wealth and easier access to resources for payment make Western-based companies particularly attractive targets.
The Growing Threat of BlackSuit Ransomware
The BlackSuit ransomware group has emerged as a significant evolution of the previously known Royal ransomware, which was active from September 2022 through June 2023. According to a joint advisory from the FBI and CISA, BlackSuit shares numerous coding similarities with Royal but has exhibited enhanced capabilities. The group is notorious for conducting data exfiltration and extortion before encrypting systems, and if a ransom is not paid, the stolen data is published on a leak site.
Phishing emails are the primary vector for initial access, after which BlackSuit actors disable antivirus software and exfiltrate large amounts of data. Ransom demands from this group typically range from $1 million to $10 million USD, with payments required in Bitcoin. Notably, the group has demanded over $500 million USD in total, with the largest individual ransom demand reaching $60 million USD. BlackSuit actors often negotiate ransom amounts directly with victims through a .onion URL on the Tor network.
Recently, an increase in direct communication from BlackSuit actors to victims, either via phone or email, has been observed. This underscores the group's aggressive tactics in ensuring payment. The group's use of a leak site to publish victim data based on non-payment further amplifies the risks posed by this sophisticated ransomware operation.
High-Profile Attack on Kadokawa Group
One of the most notable attacks attributed to BlackSuit was the cyberattack on the Japanese conglomerate Kadokawa Group. In this incident, the group managed to exfiltrate a significant amount of sensitive data, crippling the company’s operations. Kadokawa Group, known for its publishing, film, and gaming divisions, faced severe disruptions as a result of this breach. The attack highlighted BlackSuit’s capability to target large, well-established organizations and their willingness to demand hefty ransoms, further cementing their position as a formidable threat in the ransomware landscape.
In today's digital age, robust cybersecurity measures are more important than ever. At BetterWorld Technology, our team of cybersecurity experts is committed to safeguarding your business from evolving threats. We offer comprehensive solutions tailored to protect your data and infrastructure. Whether you need proactive monitoring, threat assessment, or incident response, BetterWorld Technology has the expertise to keep your business secure. Contact us today to learn how our cutting-edge cybersecurity services can fortify your defenses. Enhance your cybersecurity posture and ensure peace of mind with BetterWorld Technology.