Network Intruders Teamup With Ransomware Developers to Hack Corporate Networks

Cyberattacks rapidly growing every day, it emerges as one of the biggest challenges for businesses. Network intruders and ransomware developer groups develop an alliance with each other to maximize the revenue with the ransomware market.

They partnership together to attack the most secure and lucrative targets. AdvIntel report shows how the underground community developing multidimensional structures of criminal alliances.

Access to Corporate Network Data

Ransomware groups tend to follow several strategic methods to infect a larger number of attackers, they attack high-profile targets such as corporations or government entities to yield thousands of dollars.

To perform the operations ransomware groups collaborate with several third-parties such as network breach experts and malware developers who develop their malware strain.

“The Russian-speaking underground is a home for many skilled network breach experts who orchestrate complex intrusion operations and obtain high-profile accesses,” reads AdvIntel report.

For network breach experts monetization is a significant challenge, the ransomware groups offer a solution for monetization.

Researchers observed that a hacker dubbed “-TMT-” joined the underground community to monetize their corporate network compromises. The group advertised that they have stolen credentials of various corporate networks and the price varies from $3,000 to $5,000.

Through private chats, they provide “several accesses to compromised entities, as well as stolen credentials for administrative accounts on the victim’s websites,” reads the blog post.

Their targets are not any specific jurisdiction or industry vector. Following are the victims of “-TMT-“.

• A Latin American house products provider operating in Chile, Bolivia, and Peru – 1069 hosts, 105 servers compromised
• A Taiwanese meta manufacturer – 388 hosts,15 servers compromised
• A Colombian financial services provider – 623 hosts compromised
• An international maritime logistics services provider – 668 hosts compromised
• A network of US universities and educational institutions – 875 hosts, 87 servers compromised
• A Danish dairy producer – 1 host, 72 servers compromised
• A Bolivian energy sector company – 270 hosts, 12 servers compromised

-TMT- hacker also provided evidence for the breaches, this was reported to US law enforcement by AdvIntel. The hacker also claimed that they have exfiltrated the login credential and navigated the network to escalate privileges.

The hacker primarily focuses on the corporate networks and they use compromised RDP and malware for initial stages of the attack.

-TMT- with REvil Ransomware

In private communication -TMT- proposes that “open a single session and upload ransomware and other payloads or to provide continuous access to the network.”

“According to AdvIntel sensitive source intelligence, since August 2019, -TMT- among other ransomware collectives has been working with the REvil developers supporting their crypto locker uploads.”

The connection may originate as both the threat actors shares their specialization and both the threat actors simultaneously left the Exploit forum.

The partnership between network intruders, Metasploit/Cobalt Strike specialists and ransomware developers rely on a solid foundation to launch high-profile attacks.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Read More

ATM Jackpotting – Cutlet Maker Malware Spike Around the World to Spit the Cash From ATM

Hackers Embedded the Malicious Code Within WAV Audio Files to Gain Reverse Shell Access