Ransomware gangs are now cold-calling victims if they restore from backups without paying

guest · Dec 4, 2020

Ransomware gangs are now cold-calling victims if they restore from backups without paying
Tactic used since August by ransomware gangs like Sekhmet, Maze, Conti, and Ryuk
December 5, 2020
https://www.zdnet.com/article/ranso...-if-they-restore-from-backups-without-paying/

In attempts to put pressure on victims, some ransomware gangs are now cold-calling victims on their phones if they suspect that a hacked company might try to restore from backups and avoid paying ransom demands.

"We've seen this trend since at least August-September," Evgueni Erchov, Director of IR & Cyber Threat Intelligence at Arete Incident Response, told ZDNet on Friday.
Arete IR and Emsisoft said they've also seen scripted templates in phone calls received by their customers.

Ransomware groups that have been seen calling victims in the past include Sekhmet (now defunct), Maze (now defunct), Conti, and Ryuk, a spokesperson for cyber-security firm Emsisoft told ZDNet on Thursday.
According to a recorded call made on behalf of the Maze ransomware gang, and shared with ZDNet, the callers had a heavy accent, suggesting they were not native English speakers.
Click to expand...

ANOTHER ESCALATION IN RANSOMWARE EXTORTION TACTICS
The use of phone calls is another escalation in the tactics used by ransomware gangs to put pressure on victims to pay ransom demands after they've encrypted corporate networks.

However, while this is the first time ransomware gangs have called victims to harass them into paying, this isn't the first time that ransomware gangs have called victims.
Click to expand...

Previous tactics included the use of ransom demands that double in value if victims don't pay during an allotted time, threats to notify journalists about the victim company's breach, or threats to leak sensitive documents on so-called "leak sites" if companies don't pay.

In April 2017, the UK's Action Fraud group warned schools and universities that ransomware gangs were calling their offices, pretending to be government workers, and trying to trick school employees into opening malicious files that led to ransomware infections.
Click to expand...

guest · Dec 5, 2020

Ransomware Operators Phone Victims to Announce They’ve Been Hacked
December 3, 2020
https://hotforsecurity.bitdefender....ims-to-announce-theyve-been-hacked-24700.html

A dental practice in the US state of Georgia has learned its systems were infected with ransomware only after the attackers rang them up to clue them in.

On September 9, Galstan & Ward Family and Cosmetic Dentistry (Galstan & Ward) learned they had been infected with ransomware “when they got a phone call from a group claiming to have attacked them and demanding a ransom,” according to DataBreaches.net.
Drs. Galstan and Ward had noticed some anomalies with their computer system but thought little of it. After calling in an IT vendor to assist with the troubles, they reportedly got the call, then learned that “several files from their server were posted to a website on the dark web.”
Click to expand...

In an update to the original post, DataBreaches.net reveals that the ransomware strain used was Conti.
Click to expand...

guest · Dec 18, 2020

FBI says DoppelPaymer ransomware gang is harassing victims who refuse to pay
Family members have also been called, as threats are made to visit victims’ homes
December 16, 2020
https://www.zdnet.com/article/fbi-s...-gang-is-harassing-victims-who-refuse-to-pay/

The US Federal Bureau of Investigations says it is aware of incidents where the DoppelPaymer ransomware gang has resorted to cold-calling companies in order to intimidate and coerce victims into paying ransom demands.

The FBI PIN alert, sent on December 10, confirms a ZDNet report from December 5 that detailed similar cold-calling tactics used by four other ransomware groups: Sekhmet (now defunct), Maze (now defunct), Conti, and Ryuk.
But while our reporting tracked down phone threats made by ransomware groups to September this year, the FBI says this tactic was actually first seen with the DoppelPaymer gang months before.

"As of February 2020, in multiple instances, DoppelPaymer actors had followed ransomware infections with calls to the victims to extort payments through intimidation or threatening to release exfiltrated data," it added.
Click to expand...

Threats of violence, as in this case, are usually empty. On the other hand, threats to release or sell the data are not.

In its DoppelPaymer PIN alert, the FBI recommends that victims secure their networks to prevent intrusions in the first place, and in the case of an attack, recommended that victims notify authorities and try to avoid paying the ransom as this emboldens attackers to carry out new intrusions, enticed by the easy profits they're making.
Click to expand...

FBI - Private Industry Notification (PIN): https://assets.documentcloud.org/documents/20428892/doppelpaymer-fbi-pin-on-dec-10-2020.pdf

Log in or Sign up

Ransomware gangs are now cold-calling victims if they restore from backups without paying

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware gangs are now cold-calling victims if they restore from backups without paying

guest Guest

guest Guest

guest Guest

Useful Searches