Latest Ransomware-as-a-Service news

Sponsored Content
Ransomware as a Service and the Strange Economics of the Dark Web

Ransomware is quickly changing in 2024, with massive disruptions and large gangs shutting down. Learn from Flare how affiliate competition is changing in 2024, and what might come next.
- Sponsored by Flare
- March 27, 2024
- 10:02 AM
- 1
Ransomware payments reached record $1.1 billion in 2023

Ransomware payments in 2023 soared above $1.1 billion for the first time, shattering previous records and reversing the decline seen in 2022, marking the year as an exceptionally profitable period for ransomware gangs.
- Bill Toulas
- February 07, 2024
- 09:00 AM
- 1
Cybersecurity firm Sophos impersonated by new SophosEncrypt ransomware

Cybersecurity vendor Sophos is being impersonated by a new ransomware-as-a-service called SophosEncrypt, with the threat actors using the company name for their operation.
- Lawrence Abrams
- July 18, 2023
- 04:47 PM
- 0
Ransomware gang apologizes, gives SickKids hospital free decryptor

The LockBit ransomware gang has released a free decryptor for the Hospital for Sick Children (SickKids), saying one of its members violated rules by attacking the healthcare organization.
- Lawrence Abrams
- January 01, 2023
- 02:00 PM
- 7
Sponsored Content
Ransomware detection with Wazuh SIEM and XDR platform

Wazuh is a free, open source SIEM/XDR solution with more than 10 million annual downloads. Learn more about how Wazuh can help protect your organization against the ever-evolving tactics of ransomware.
- Sponsored by Wazuh
- November 29, 2022
- 10:05 AM
- 0
Dozens of ransomware variants used in 722 attacks over 3 months

The ransomware space was very active in the last quarter of 2021, with threat analysts observing 722 distinct attacks deploying 34 different variants.
- Bill Toulas
- March 15, 2022
- 05:40 PM
- 0
ALPHV BlackCat - This year's most sophisticated ransomware

The new ALPHV ransomware operation, aka BlackCat, launched last month and could be the most sophisticated ransomware of the year, with a highly-customizable feature set allowing for attacks on a wide range of corporate environments.
- Lawrence Abrams
- December 09, 2021
- 04:47 PM
- 0
Translated Conti ransomware playbook gives insight into attacks

Almost a month after a disgruntled Conti affiliate leaked the gang's attack playbook, security researchers shared a translated variant that clarifies on any misinterpretation caused by automated translation.
- Ionut Ilascu
- September 02, 2021
- 05:10 PM
- 0
Angry Conti ransomware affiliate leaks gang's attack playbook

A disgruntled Conti affiliate has leaked the gang's training material when conducting attacks, including information about one of the ransomware's operators.
- Lawrence Abrams
- August 05, 2021
- 02:29 PM
- 1
Paradise Ransomware source code released on a hacking forum

The complete source code for the Paradise Ransomware has been released on a hacking forum allowing any would-be cyber criminal to develop their own customized ransomware operation.
- Lawrence Abrams
- June 15, 2021
- 11:56 AM
- 7
DarkSide ransomware is creating a secure data leak service in Iran

The DarkSide Ransomware operation claims they are creating a distributed storage system in Iran to store and leak data stolen from victims. To show they mean business, the ransomware gang has deposited $320 thousand on a hacker forum.
- Lawrence Abrams
- November 13, 2020
- 03:00 AM
- 0
REvil ransomware deposits $1 million in hacker recruitment drive

The REvil Ransomware (Sodinokibi) operation has deposited $1 million in bitcoins on a Russian-speaking hacker forum to prove to potential affiliates that they mean business.
- Lawrence Abrams
- September 28, 2020
- 01:30 AM
- 0
Iranian hackers attack exposed RDP servers to deploy Dharma ransomware

Low-skilled hackers likely from Iran have joined the ransomware business targeting companies in Russia, India, China, and Japan. They are going after easy hits, using publicly available tools in their activity.
- Ionut Ilascu
- August 24, 2020
- 05:12 AM
- 1
Dharma ransomware created a hacking toolkit to make cybercrime easy

The Dharma Ransomware-as-a-Service (RaaS) operation makes it easy for a wannabe cyber-criminal to get into the ransomware business by offering a toolkit that does almost everything for them.
- Lawrence Abrams
- August 12, 2020
- 02:46 PM
- 0
GandCrab ransomware operator arrested in Belarus

An affiliate of the GandCrab ransomware-as-a-business (RaaS) has been arrested, according to some Russian news sources. Authorities in Russia were able to identify the individual in cooperation with law enforcement in Romania and the U.K.
- Ionut Ilascu
- July 31, 2020
- 06:13 PM
- 2
The Week in Ransomware - May 15th 2020 - REvil targets Trump

This week, we saw some interesting news about ransomware features being added and continued attackers against high profile victims.
- Lawrence Abrams
- May 16, 2020
- 02:13 PM
- 1
Tools and Tactics of the Sodinokibi Ransomware Distributors

Using a network of honeypots, researchers from McAfee examined the tools and tactics used by the Sodinokibi Ransomware (REvil) affiliates to infect their victims with ransomware and compromise other machines on the network.
- Lawrence Abrams
- October 21, 2019
- 12:01 AM
- 1
Sodinokibi Ransomware: Following the Affiliate Money Trail

After a Sodinokibi ransomware affiliate posted partial transaction IDs for ransomware payments, researchers were able to use that information to follow the money trail for affiliates and in some cases, how they spend their illicit earnings.
- Lawrence Abrams
- October 14, 2019
- 12:01 AM
- 0
Sodinokibi Ransomware Builds An All-Star Team of Affiliates

The Sodinokibi Ransomware (REvil) has been making news lately as they target the enterprise, MSPs, and government entities through their hand-picked team of all-star affiliates. These affiliates appear to have had a prior history with the GandCrab RaaS and use similar distribution methods.
- Lawrence Abrams
- October 02, 2019
- 12:24 PM
- 0
Jokeroo Ransomware as a Service Pulls an Exit Scam

Since May 7th, 2019, the Tor sites for the Jokeroo Ransomware as a Service (RaaS) have started displaying a notice stating that their server was seized by the Royal Thai Police in conjunction with the Dutch National Police and Europol. It turns out that this notice is fake and the RaaS is performing an exit scam.
- Lawrence Abrams
- May 09, 2019
- 02:24 PM
- 0