On the internet, nobody knows you’re a dog!
These words from Peter Steiner’sfamous cartooncould easily be applied to the recentransomware attackon Florida-based software supplier Kaseya.
Kaseya provides software services to thousands of clients around the world. It’s estimated between800 and 1,500 medium to small businessesmay be impacted by the attack, with the hackers demanding US$50 million (lower than the previously reported US$70 million) in exchange for restoring access to data being held for ransom.
Hackers behind this attack, REvil#ransomware-as-a-service (RaaS) group, swiftly lowered the asking price to $50 million, suggesting a willingness to negotiate their demands in return for a lesser amount.
— The Hacker News (@TheHackersNews)July 6, 2021
The global ransomware attack has beenlabeledthe biggest on record. Russian cybercriminal organization REvil is the alleged culprit.
Calling all Scaleup founders! Join the Soonicorn Summit on November 28 in Amsterdam.
Meet with the leaders of Picnic, Miro, Carbon Equity and more during this exclusive event dedicated to Scaleup Founders!
Despite its notoriety, nobody really knows what REvil is, what it’s capable of, or why it does what it does — apart from the immediate benefit of huge sums of money. Also, ransomware attacks often involve vast distributed networks, so it’s not even certain the individuals involved wouldknow each other.
Ransomware attacks aregrowing exponentiallyin size and ransom demand — changing the way we operate online. Understanding who these groups are and what they want is critical to take them down.
Here, we list the top five most dangerous criminal organizations currently online. As far as we know, these rogue groups aren’t backed orsponsored by any state.
DarkSide
DarkSide is the group behind theColonial Pipelineransom attack in May, which shut down the US Colonial Pipeline’s fuel distribution network, triggering gasoline shortage concerns.
The group seemingly first emerged in August last year. It targetslarge companiesthat will suffer from any disruption to their services — a key factor, as they’re then more likely to pay a ransom. Such companies are also more likely to havecyber insurancewhich, for criminals, means easy money-making.
DarkSide’s business model is to offer aransomware service. In other words, it carries out ransomware attacks on behalf of other, hidden perpetrator/s so they can lessen their liability. The executor and perpetrator then share profits.
Groups that offer cybercrime-as-a-service also provide online forum communications to support others who may want to improve their cybercrime skills.
This might involve teaching someone how to combinedistributed denial-of-service (DDoS) and ransomwareattacks, to put extra pressure on negotiations. The ransomware would prevent a business from working on past and current orders, while a DDoS attack would block any new orders.
REvil
The ransomware-as-a-service group REvil is currently making headlines due to the ongoing Kaseya incident, as well as another recent attack onglobal meat processing company JBS. This group has been particularly active in 2020-2021.
REvil’s HappyBlog web site showing US$70m ransom demand. Author provided
In April, REvil stole technical data on unreleased Apple products from Quanta Computer, a Taiwanese company that assembles Apple laptops. Aransom of US$50 millionwas demanded to prevent public release of the stolen data. It hasn’t been revealed whether or not this money was paid.
Clop
The ransomwareClopwas created in 2019 by a financially motivated group responsible for yieldinghalf a billion US dollars.
The Clop group’s specialty is “double-extortion”. This involves targeting organizations with ransom money in exchange for a decryption key that will restore the organization’s access to stolen data. However, targets will then have to pay extra ransom to not have the data released publicly.
Historical examples reveal that organizations which pay a ransom once are more likely to pay again in the future. So hackers will tend to target the same organizations again and again, asking for more money each time.
ClopLeaks website showing directly downloadable ransom files. Author provided
Syrian Electronic Army
Far from a typical cybercrime gang, the Syrian Electronic Army has been launching online attacks since 2011 to promote political propaganda. With this motive, they have been dubbed ahactivistgroup.
While the group haslinkswith Bashar al-Assad’s regime, it’s more likely made up ofonline vigilantestrying to bemedia auxiliaryfor the Syrian army.
Their technique is to distributefake newsthrough reputable sources. In 2013, a single tweet sent by them from the official account of the Associated Press, the world’s leading news agency, had the effect ofwiping billionsfrom the stock market.
The fake AP tweet from the Syrian Electronic Army. www.theatlantic.com/
The Syrian Electronic Army exploits the fact that most people online have a tendency to interpret and react to content with an implicit sense of trust. And they’re a prime example of how theboundariesbetween crime and terror groups online are less distinct than in the physical world.
FIN7
If this list could contain a “super villain”, it would be FIN7. Another Russian-based group, FIN7 is arguably the mostsuccessfulonline criminal organization of all time. Operating since 2012, it mainly works as abusiness.
Many of its operations have been undetected for years. Its data breaches have exploitedcross-attackscenarios, wherein the data breach serves multiple purposes. For example, it may enable extortion through ransom while also allowing the attacker to use data against victims, such as by reselling it to a third party.
In early 2017, FIN7 was alleged to be behind an attack targetingcompanies providing filingsto the US Security and Exchange Commission. This confidential information was exploited and used to obtain ransom which was then invested on the stock exchange.
As such, the groups made huge sums of money by trading on confidential information. Theinsider tradingscheme facilitated by hacking went on for many years — which is why it’s not possible to quantify the exact amount of economic damage. But it’s estimated to be well over US$1 billion.
Organized crime vs organized criminals
When it comes to complex criminal organizations,techniquesevolveandmotivesvary.
The way they organize themselves and commit crimes online is very different from your local offline gang. Ransomware can be launched from anywhere in the world, so it’s very difficult to prosecute these criminals. Matters are made even more complicated when several parties coordinate across borders.
It’s no wonder the challenge for law enforcement agencies is significant. It’s crucial that authorities investigating an attack are sure it was indeed perpetrated by who they suspect. But to know this, they need all the help they can get.
Article byRoberto Musotto, Research fellow,Edith Cowan University;Brianna O’Shea, Lecturer, Ethical Hacking and Defense,Edith Cowan University, andPaul Haskell-Dowland, Associate Dean (Computing and Security),Edith Cowan University
This article is republished fromThe Conversationunder a Creative Commons license. Read theoriginal article.
Story byThe Conversation
An independent news and commentary website produced by academics and journalists.An independent news and commentary website produced by academics and journalists.
Get the TNW newsletter
Get the most important tech news in your inbox each week.
