Cybercriminals and ransomware groups are targeting each other. But bad guys are still bad guys, and this new development doesn’t lessen your risk.
Even if you think you’ve seen everything when it comes to what cybercriminals are willing to do, this one may come as a shock.
Recently, several high-profile ransomware groups and cybercriminal rings have themselves gotten hacked.
The culprit wasn’t a government or law enforcement agency. It was another group of bad guys.
And while this might sound like good news at first, it really isn’t.
We’ll explain what you need to know below.
What’s Happening: Cybercriminals Are Targeting Each Other
In the last couple of years, various cyber gangs have gotten into online turf wars not all that different from what you might see portrayed in your favorite crime drama. Only instead of drugs and guns, these gangs deal in stolen data and malware.
BlackFog reported last year on two cases, though there have been many more.
In one, the Everest gang — a Russia-affiliated group that hacks organizations and governments and then posts stolen data on the dark web while it seeks ransom payments — saw their dark web site compromised. It seems a competing gang broke in and defaced the digital storefront, placing a sarcastic “Don’t do crime” message front and center.
In the other, two groups got into a more dramatic confrontation. RansomHub was having some internal challenges when DragonForce announced on the dark web that it had essentially absorbed RansomHub. Only, no one told RansomHub.
Why It’s Happening
Well, lots of reasons. In some cases, it’s a little capitalism-adjacent. One “company” seems to be faltering, so another larger entity comes along and buys it out. But since they’re all criminals, “buys it out” usually looks more like “steals all the assets.”
In others, it’s a more traditional turf war, where one gang doesn’t appreciate encroachment from another and decides to send a message.
Sometimes it’s retaliation over money disputes, like a group that doesn’t split the ransom money like they said they would.
By this point you may be sensing a theme: people who make their living doing crime aren’t exactly the most trustworthy bunch.
And that point is more important than it seems at first.
Beware the “Merciful” Cybercriminal
In some of these situations, one gang may threaten to unlock or restore data that the other gang stole. They’re essentially ransomware-ing the ransomware.
There have even been “merciful” cybercriminals that steal stolen data and then offer it back to the original owner at a discount.
But here’s the thing: you can’t trust one group of thieves over the other. Thieves, well, steal stuff. It’s what they do.
If this happens to your business, the new bad guy might do what they say. Or they might extort you for even more money.
But for that matter, you don’t even have a way to know that they can give you your data back.
The Best Defense Is Good Defense, Not a “Good” Bad Guy
We hope none of you ever end up falling victim to a ransomware attack. And we certainly hope you don’t end up in the middle of a cybergang turf war!
The best way to protect yourself is to build up your defenses before disaster strikes. This means:
- Security measures in place that follow latest best practices
- Qualified cybersecurity support
- Tested, accessible, consistent backups
- Having a disaster management / cybersecurity response plan
If you aren’t confident in your business’s defense strategies, we can help you craft something more complete and more resilient. Reach out anytime.