A brand new report centered on cyber espionage actors focusing on authorities and important infrastructure sectors highlights the strategic use of ransomware for distraction or misattribution.
It was inevitable: a risk group utilizing a secondary assault kind to cowl their tracks – whether or not these “tracks” are the teams true intent, who’s accountable – or to easily make some extra cash after they’re completed with the preliminary assault.
A new report put out collectively by safety vendor SentinelOne and Recorded Future follows Chinese language APT group ChamelGang who’re recognized to be chargeable for assaults in East Asia, Brazil, and the Indian subcontinent. The report showcases a brand new assault tactic being added by risk teams – together with ChamelGang – who’re sponsored by nation-states, including in knowledge encryption, exfiltration, and extortion.
This extra tactic offers sponsoring nations to have believable deniability, misdirects the response of focused governments, and even can hold sufferer organizations from understanding they have been the goal of espionage within the first place. It additionally turns into a handy method for risk teams to “make an additional buck” off the sufferer, since “they’re there already.”
This added tactic makes cyber assaults materially extra harmful; it’s not out of the realm of risk to see ransomware risk actors constructing out a brand new enterprise mannequin that works – in essence – in reverse of a gaggle like ChamelGang. Right here’s what I imply: say a ransomware group has established their preliminary entry and has quietly deployed their ransomware in all places.
All it takes is a few risk actor to setup an “espionage market” the place nation-states can search for entry they’d wish to benefit from for espionage functions, join the sponsor and the ransomware group, and add in some knowledge exfiltration particularly centered on espionage, promoting the info to the sponsor – and then persevering with with the ransomware assault.
Scary stuff.
All of the extra cause to work to cease assaults at their preliminary entry step – which nonetheless primarily leverages phishing. This makes new faculty safety consciousness coaching important as a part of your group’s defenses to maintain from being a sufferer not simply as soon as, however from the seems of issues… twice.