Scattered Spider Adopts RansomHub and Qilin Ransomware for Cyber Attacks

Scattered Spider Adopts RansomHub and Qilin Ransomware for Cyber Attacks

July 17, 2024 at 02:54AM

Cybercrime group Scattered Spider has integrated ransomware strains RansomHub and Qilin in its activities, per Microsoft. Scattered Spider employs social engineering to breach and persist in targets, with a history of targeting VMWare ESXi servers. RansomHub, a widely used ransomware, has been linked to various threat actors. Microsoft urges security best practices amidst evolving ransomware threats.

From the meeting notes, the key takeaways are:

– The cybercrime group Scattered Spider has incorporated ransomware strains RansomHub and Qilin into its arsenal.
– Scattered Spider is known for its social engineering schemes, targeting VMWare ESXi servers, and deploying BlackCat ransomware.
– Scattered Spider is linked to other activity clusters known as 0ktapus, Octo Tempest, and UNC3944.
– RansomHub has been assessed to be a rebrand of another ransomware strain called Knight.
– RansomHub is a widely used ransomware-as-a-service (RaaS) payload by various threat actors.
– RansomHub has been observed in post-compromise activities by Manatee Tempest following initial access obtained by Mustard Tempest.
– Mustard Tempest has utilized FakeUpdates in attacks associated with actions resembling pre-ransomware behavior of Evil Corp.
– Emerging ransomware families include FakePenny (attributed to Moonstone Sleet), Fog (distributed by Storm-0844), and ShadowRoot (targeting Turkish businesses using fake PDF invoices).
– Users and organizations are advised to follow security best practices, especially credential hygiene, principle of least privilege, and Zero Trust.

The information provides crucial insights into the modus operandi, affiliations, and emerging threats posed by cybercrime groups and ransomware families.

Full Article