Latest Affiliates news

LockBit ransomware returns to attacks with new encryptors, servers

The LockBit ransomware gang is once again conducting attacks, using updated encryptors with ransom notes linking to new servers after last week's law enforcement disruption.
- Lawrence Abrams
- February 28, 2024
- 01:31 PM
- 0
The Week in Ransomware - December 29th 2023 - LockBit targets hospitals

It's been a quiet week, with even threat actors appearing to take some time off for the holidays. We did not see much research released on ransomware this week, with most of the news focusing on new attacks and LockBit affiliates increasingly targeting hospitals.
- Lawrence Abrams
- December 29, 2023
- 03:39 PM
- 0
LockBit ransomware now poaching BlackCat, NoEscape affiliates

The LockBit ransomware operation is now recruiting affiliates and developers from the BlackCat/ALPHV and NoEscape after recent disruptions and exit scams.
- Lawrence Abrams
- December 13, 2023
- 01:22 PM
- 0
The Week in Ransomware - December 1st 2023 - Police hits affiliates

An international law enforcement operation claims to have dismantled a ransomware affiliate operation in Ukraine, which was responsible for attacks on organizations in 71 countries.
- Lawrence Abrams
- December 01, 2023
- 05:11 PM
- 1
ShadowSyndicate hackers linked to multiple ransomware ops, 85 servers

Security researchers have identified infrastructure belonging to a threat actor now tracked as ShadowSyndicate, who likely deployed seven different ransomware families in attacks over the past year.
- Bill Toulas
- September 26, 2023
- 05:11 AM
- 0
The Week in Ransomware - August 18th 2023 - LockBit on Thin Ice

While there was quite a bit of ransomware news this week, the highlighted story was the release of Jon DiMaggio's third article in the Ransomware Diaries series, with the focus of this article on the LockBit ransomware operation.
- Lawrence Abrams
- August 18, 2023
- 05:07 PM
- 0
Suspected LockBit ransomware affiliate arrested, charged in US

Russian national Ruslan Magomedovich Astamirov was arrested in Arizona and charged by the U.S. Justice Department for allegedly deploying LockBit ransomware on the networks of victims in the United States and abroad.
- Sergiu Gatlan
- June 15, 2023
- 01:33 PM
- 1
Ransomware gang apologizes, gives SickKids hospital free decryptor

The LockBit ransomware gang has released a free decryptor for the Hospital for Sick Children (SickKids), saying one of its members violated rules by attacking the healthcare organization.
- Lawrence Abrams
- January 01, 2023
- 02:00 PM
- 7
Netwalker ransomware affiliate sentenced to 20 years in prison

Former Netwalker ransomware affiliate Sebastien Vachon-Desjardins has been sentenced to 20 years in prison and demanded to forfeit $21.5 million for his attacks on a Tampa company and other entities.
- Lawrence Abrams
- October 04, 2022
- 04:10 PM
- 2
Microsoft: Exchange servers hacked to deploy BlackCat ransomware

Microsoft says BlackCat ransomware affiliates are now attacking Microsoft Exchange servers using exploits targeting unpatched vulnerabilities.
- Sergiu Gatlan
- June 13, 2022
- 01:14 PM
- 0
REvil ransomware member extradited to U.S. to stand trial for Kaseya attack

The U.S. Department of Justice announced that alleged REvil ransomware affiliate, Yaroslav Vasinskyi, was extradited to the United States last week to stand trial for the Kaseya cyberattack.
- Bill Toulas
- March 10, 2022
- 01:23 PM
- 0
Police arrests ransomware affiliate behind high-profile attacks

Romanian law enforcement authorities arrested a ransomware affiliate suspected of hacking and stealing sensitive info from the networks of multiple high-profile companies worldwide, including a large Romanian IT company with clients from the retail, energy, and utilities sectors.
- Sergiu Gatlan
- December 13, 2021
- 07:51 AM
- 1
Alleged ransomware affiliate arrested for healthcare attacks

A 31-year old Canadian national has been charged in connection to ransomware attacks against organizations in the United States and Canada, a federal indictment unsealed today shows.
- Ionut Ilascu
- December 07, 2021
- 03:37 PM
- 1
Yanluowang ransomware operation matures with experienced affiliates

An affiliate of the recently discovered Yanluowang ransomware operation is focusing its attacks on U.S. organizations in the financial sector using BazarLoader malware in the reconnaissance stage.
- Ionut Ilascu
- November 30, 2021
- 06:56 AM
- 0
U.S. offers $10 million reward for leaders of REvil ransomware

The U.S. is offering up to $10 million for identifying or locating leaders in the REvil (Sodinokibi) ransomware operation, including $5 million leading to the arrest of affiliates.
- Lawrence Abrams
- November 08, 2021
- 07:11 PM
- 2
REvil ransomware affiliates arrested in Romania and Kuwait

Romanian law enforcement authorities have arrested two suspects believed to be Sodinokibi/REvil ransomware affiliates, allegedly responsible for infecting thousands of victims.
- Sergiu Gatlan
- November 08, 2021
- 09:51 AM
- 1
Translated Conti ransomware playbook gives insight into attacks

Almost a month after a disgruntled Conti affiliate leaked the gang's attack playbook, security researchers shared a translated variant that clarifies on any misinterpretation caused by automated translation.
- Ionut Ilascu
- September 02, 2021
- 05:10 PM
- 0
Angry Conti ransomware affiliate leaks gang's attack playbook

A disgruntled Conti affiliate has leaked the gang's training material when conducting attacks, including information about one of the ransomware's operators.
- Lawrence Abrams
- August 05, 2021
- 02:29 PM
- 1
Watch out: These online casino emails never pay what they promise

Spammers are abusing affiliate programs to promote online casinos, such as Raging Bull Casino, Sports and Casino, Ducky Luck, and Royal Ace Casino, with misleading emails.
- Lawrence Abrams
- June 05, 2021
- 10:45 AM
- 0
DarkSide ransomware will now vet targets after pipeline cyberattack

The DarkSide ransomware gang posted a new "press release" today stating that they are apolitical and will vet all targets before they are attacked.
- Lawrence Abrams
- May 10, 2021
- 11:40 AM
- 4