Ransomware gangs have a new technique to recruit affiliates: posting announcements on their own data leaks websites. This provides a look into today’s so-called ransomware-as-a-service (RaaS), in which people can pay to have some of the work automated for them. This shift has come about in large part because two major ransomware forums banned gangs from promoting their RaaS schemes.

Take a look at what types of messaging a few groups are using on their sites to invite attackers in.

Boasting and Warnings Abound

In late June, the LockBit group announced a new version of their ransomware strain on their data leaks site. The malware authors announced a new recruitment session at the same time as their announcement of LockBit 2.0.

The gang claimed their product carried “unparalleled benefits [including] encryption speed and self-spread function.” All an affiliate needed to do in an attack was “get access to the core server, while LockBit 2.0 will do all the rest.” Then, the infection would spread to all devices on the domain network, they stated.

The Himalaya RaaS gang began looking for new recruits on its data leaks site at around the same time. The gang claimed that affiliates could keep 70% of whatever profits they made in their attacks using the authors’ “already configured and compiled FUD [Fully UnDetectable]” malware. The group also imposed limits, saying that affiliates were not allowed to target health care organizations, non-profits and public entities.

Digital Crime Forums Not as Friendly as Before

The LockBit and Himalaya groups’ new recruitment tactic reflects a larger change in the crypto-ransomware threat landscape. This change first became evident in mid-May 2021 following a high-profile ransomware infection involving a pipeline company. As reported by KrebsonSecurity, an admin on the Russian digital crime forum XSS announced that the forum would no longer allow members to post about ransomware programs like for-profit RaaS schemes.

Around that same time, the Exploit digital crime forum also announced that it was banning members from posting ads to hire RaaS recruits.

How to Defend Against Ransomware Attacks

So long as it lets them make money, ransomware authors will always find new ways to recruit new partners to their cause. That’s why it’s important for businesses and agencies to revisit their defenses on an ongoing basis.

For instance, make sure you have multi-factor authentication (MFA) on the accounts of all employees and contractors. Doing this will help to prevent ransomware attackers from gaining access to a privileged account. That’s true even if they pull off a successful phish and misuse that access to deploy their payload.

Organizations can then balance their MFA scheme by deploying a user behavior analytics solution. This can help to alert security teams if and when someone succeeds in getting access to an authorized account.

More from News

$10.3 Billion in Cyber Crime Losses Shatters Previous Totals

4 min read - The introduction of the most recent FBI Internet Crime Report says, “At the FBI, we know ‘cyber risk is business risk’ and ‘cybersecurity is national security.’” And the numbers in the report back up this statement. The FBI report details more than 800,000 cyber crime-related complaints filed in 2022. Meanwhile, total losses were over $10 billion, shattering 2021's total of $6.9 billion, according to the bureau’s Internet Crime Complaint Center (IC3).  Top Five Cyber Crime TypesIn the past five years, the…

4 min read

HHS Releases Hospital Cyber Resiliency Landscape Analysis

4 min read - On April 17, 2023, The U.S. Department of Health and Human Services (HHS) 405(d) Program announced the release of its Hospital Cyber Resiliency Initiative Landscape Analysis. This landmark analysis reports on domestic hospitals’ current state of cybersecurity preparedness. The scope of the HHS study was limited to activities that protect access to patient care and safety and reduce the negative impact of cyber threats on clinical operations. Breaches of sensitive data were considered only if the breach had a direct…

4 min read

Zombie APIs are a Top Security Concern as API Attacks Surge 400%

4 min read - Organizations of all sizes rely on application programming interfaces (APIs). The API explosion has been driven by several factors, including cloud computing, demand for mobile/web applications, microservices architecture and the API economy as a business model. APIs enable developers to access data remotely, integrate with other services, build modular applications and monetize their data/services. For enterprises that participated in a recent research study, the average number of APIs per organization was 15,564. Large enterprises (over 10,000 employees) had an average…

4 min read

Google’s Bug Bounty Hits $12 Million: What About the Risks?

4 min read - Bug bounty numbers have never been better. In 2022, Google rewarded the efforts of over 700 researchers from 68 different countries who helped improve the security of the company’s products and services. The total amount of awards grew from $8.7 million paid in 2021 to $12 million in 2022, a nearly 38% increase. Over the past few years, bug bounty programs have gained significant traction. Companies have been lured in by the potential to identify vulnerabilities quickly, enhance product security…

4 min read