Thursday, February 22, 2024

Network Intruders Teamup With Ransomware Developers to Hack Corporate Networks

Cyberattacks rapidly growing every day, it emerges as one of the biggest challenges for businesses. Network intruders and ransomware developer groups develop an alliance with each other to maximize the revenue with the ransomware market.

They partnership together to attack the most secure and lucrative targets. AdvIntel report shows how the underground community developing multidimensional structures of criminal alliances.

Access to Corporate Network Data

Ransomware groups tend to follow several strategic methods to infect a larger number of attackers, they attack high-profile targets such as corporations or government entities to yield thousands of dollars.

To perform the operations ransomware groups collaborate with several third-parties such as network breach experts and malware developers who develop their malware strain.

“The Russian-speaking underground is a home for many skilled network breach experts who orchestrate complex intrusion operations and obtain high-profile accesses,” reads AdvIntel report.

For network breach experts monetization is a significant challenge, the ransomware groups offer a solution for monetization.

Researchers observed that a hacker dubbed “-TMT-” joined the underground community to monetize their corporate network compromises. The group advertised that they have stolen credentials of various corporate networks and the price varies from $3,000 to $5,000.

Corporate Network
Network Intruders and Ransomware Syndicates Join Efforts Credits: AdvIntel

Through private chats, they provide “several accesses to compromised entities, as well as stolen credentials for administrative accounts on the victim’s websites,” reads the blog post.

Their targets are not any specific jurisdiction or industry vector. Following are the victims of “-TMT-“.

  • A Latin American house products provider operating in Chile, Bolivia, and Peru – 1069 hosts, 105 servers compromised
  • A Taiwanese meta manufacturer – 388 hosts,15 servers compromised
  • A Colombian financial services provider – 623 hosts compromised
  • An international maritime logistics services provider – 668 hosts compromised
  • A network of US universities and educational institutions – 875 hosts, 87 servers compromised
  • A Danish dairy producer – 1 host, 72 servers compromised
  • A Bolivian energy sector company – 270 hosts, 12 servers compromised

-TMT- hacker also provided evidence for the breaches, this was reported to US law enforcement by AdvIntel. The hacker also claimed that they have exfiltrated the login credential and navigated the network to escalate privileges.

The hacker primarily focuses on the corporate networks and they use compromised RDP and malware for initial stages of the attack.

-TMT- with REvil Ransomware

In private communication -TMT- proposes that “open a single session and upload ransomware and other payloads or to provide continuous access to the network.”

“According to AdvIntel sensitive source intelligence, since August 2019, -TMT- among other ransomware collectives has been working with the REvil developers supporting their crypto locker uploads.”

The connection may originate as both the threat actors shares their specialization and both the threat actors simultaneously left the Exploit forum.

The partnership between network intruders, Metasploit/Cobalt Strike specialists and ransomware developers rely on a solid foundation to launch high-profile attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Read More

ATM Jackpotting – Cutlet Maker Malware Spike Around the World to Spit the Cash From ATM

Hackers Embedded the Malicious Code Within WAV Audio Files to Gain Reverse Shell Access


Latest articles

Earth Preta Hackers Abuses Google Drive to Deploy DOPLUGS Malware

Threat actors abuse Google Drive for several malicious activities due to its widespread use,...

Swiggy Account Hacked, Hackers Placed Orders Worth Rs 97,000

In a startling incident underscoring the growing menace of cybercrime, a woman's Swiggy account...

Beware of VietCredCare Malware that Steals businesses’ Facebook Accounts

A new cybersecurity threat targeting Facebook advertisers in Vietnam, known as VietCredCare, has emerged....

Google Chrome 122 Update Addresses Critical Security Vulnerabilities

Google has recently unveiled Chrome 122, a significant milestone for the widely used web...

New Malicious PyPI Packages Use DLL Sideloading In A Supply Chain Attack

Researchers have discovered that threat actors have been using open-source platforms and codes for...

New Mingo Malware Attacking Linux Redis Servers To Mine Cryptocurrency

The malware, termed Migo by the creators, attempts to infiltrate Redis servers to mine cryptocurrency on...

Security Onion 2.4.50 Released for Defenders With New Features

Security Onion Solutions has recently rolled out the latest version of its network security...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles