Ransomware in the CIS – Russian orgs heavily targeted by smaller tier ransomware gangs

guest · Oct 8, 2021

Russian orgs heavily targeted by smaller tier ransomware gangs
October 8, 2021
https://www.bleepingcomputer.com/ne...ly-targeted-by-smaller-tier-ransomware-gangs/

Even though American and European companies enjoy the lion’s share of ransomware attacks launched from Russian ground, companies in the country aren’t spared from having to deal with file encryption and double-extortion troubles of their own.

The actors who trouble Russian and CIS-based companies in general though, aren’t REvil, LockBit, DarkSide, and any of the more notorious groups that launch high-profile attacks on critical infrastructure targets.
Click to expand...

As Kaspersky explains in a detailed roundup on cyberattacks in the first half of 2021, the CIS (Commonwealth of Independent States) is also the target of a vivid cyber-criminal ecosystem targeting Russian firms every month, and most of them go unreported.

The groups that comprise this largely ignored subcategory of ransomware actors are typically less sophisticated, predominately use older strains or leaked malware,and establish intrusion on their own instead of buying access to the targets.

The most notable the ransomware families that were deployed this year against Russian targets are the following:
Click to expand...

BigBobRoss

Crysis/Dharma

Phobos/Eking

Cryakl/CryLock

CryptConsole

Fonix/XINOF

Limbozar/VoidCrypt

Thanos/Hakbit

XMRLocker

Those that stand out as the historically most successful strains are Dharma and Phobos.

Although these RaaS programs come and go, they’re not without firepower. Kaspersky warns that some of these strains are still developing, with authors working on making their strains more potent, so none should be ignored.
Russian companies can prevent many of these threats by simply blocking RDP access, using strong passwords for domain accounts that are changed regularly, and accessing corporate networks through VPN.
Click to expand...

Kaspersky: Ransomware in the CIS

Most of the groups you might read about in the news today tend to operate outside the CIS. That said, companies in this region still cannot relax, since they are the target of dozens of lesser-known groups.

This roundup spotlights the ransomware Trojan families that most actively attacked businesses in the CIS in H1 2021, and their technical characteristics.
Click to expand...

Floyd 57 · Oct 8, 2021

Just put Kaspersky, EZ. The ransomware will be BEGGING for mercy

Log in or Sign up

Ransomware in the CIS – Russian orgs heavily targeted by smaller tier ransomware gangs

guest Guest

Floyd 57 Registered Member

Log in or Sign up

Ransomware in the CIS – Russian orgs heavily targeted by smaller tier ransomware gangs

guest Guest

Floyd 57 Registered Member

Useful Searches