When the three day mark is reached, “sample files” are made public. If you’re unfortunate enough to end up on the leak portal, your details are organised like so:Ĭustomised ransom notes are used for compromised entities, with three days given to pay up or risk the data being made public.
Talos reports that the main leak site is undergoing various cosmetic tweaks and alterations, confirming the impression that this is all very new indeed. Watching confidential information be spilled across the internet for download is certainly one way to encourage a business to pay up, and an effective tactic. In this case, RA Group is sticking with the tried and tested leak portal technique. This is where the target isn’t just stuck with encrypted, inaccessible files, they’re also threatened with the stolen data being leaked should the ransom not be paid. According to Talos, like many other forms of ransomware, the attacks are based around double extortion tactics. Our latest Babuk beneficiary, the RA Group, already has four known compromises in the US and South Korea. Its versatility and relative ease of use ensures that-sadly-we’ll likely be seeing Babuk lurking at the edges of ransomware development for a long time to come. The leaked builder has proven to be very useful for those in the ransomware realm, and people wanting to get in on the act.
Babuk code has also been reused prior to this latest group, for example as the basis for Rook ransomware at the end of 2021. Babuk popped up in all sorts of attacks, like being deployed via Microsoft Exchange exploits.
While some of these antics may sound faintly comical, the ransomware was no joke. Researchers from Cisco Talos have named this new team the “RA Group”, a ransomware collective which may have only been up and running since last month.īabuk famously threatened to leak law enforcement data, relented, and then had its ransomware builder tool leaked during the weirdest retirement ever. The bones of long gone ransomware group Babuk continue to rattle in the breeze, in the form of reused code.
0 kommentar(er)
