Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new Ransomware-as-a-Service (RaaS) group called GLOBAL GROUP has emerged, likely a rebranding of the BlackLock RaaS operation. The group targets various sectors across the US and Europe, with a focus on healthcare providers. GLOBAL GROUP utilizes Initial Access Brokers to gain entry to vulnerable edge appliances and employs brute-force tools for Microsoft Outlook and RDWeb portals. Their ransom negotiation panel features AI-driven chatbots, enabling non-English-speaking affiliates to engage victims more effectively. The group offers an 85% revenue share to affiliates and provides a mobile-friendly control panel. GLOBAL GROUP's infrastructure has been traced to a Russia-based VPS provider, and their operations show similarities to previous Mamona ransomware activities.

The GLOBAL GROUP ransomware-as-a-service (RaaS) campaign represents a sophisticated evolution in ransomware operations, likely a rebranding of the previously known BlackLock RaaS. This group targets multiple sectors across the US and Europe, with a pronounced focus on healthcare providers, a sector known for critical data and operational sensitivity. GLOBAL GROUP leverages Initial Access Brokers (IABs) to gain footholds in victim networks, specifically exploiting vulnerable edge appliances. They also employ brute-force attacks targeting Microsoft Outlook and RDWeb portals, common vectors for remote access and email compromise. A notable innovation in their operation is the integration of AI-driven chatbots within their ransom negotiation panel, which facilitates multilingual communication and enables affiliates who may not be fluent in English to negotiate effectively with victims. This AI-enhanced negotiation capability likely increases the success rate of ransom payments by improving communication and persuasion. The group offers an attractive 85% revenue share to affiliates, incentivizing widespread participation. Additionally, GLOBAL GROUP provides a mobile-friendly control panel, enhancing operational flexibility for affiliates to manage campaigns remotely. Their infrastructure is hosted on a Russia-based VPS provider, and their tactics and infrastructure bear resemblance to the Mamona ransomware group, suggesting possible shared resources or lineage. The campaign employs a broad range of tactics, techniques, and procedures (TTPs) including brute-force (T1110), exploitation of remote services (T1190), persistence mechanisms (T1505.003), and ransomware deployment (T1486). Indicators of compromise include multiple file hashes, IP addresses, and onion domains used for command and control or ransom negotiation. Although no known exploits are currently reported in the wild, the campaign's use of brute-force and initial access brokers indicates a high likelihood of successful intrusions where security controls are weak or outdated.

Detailed information about Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates. Get real-time updat

Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates - Live Threat Intelligence - Threat Radar | OffSeq.com

Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates

A breach of LockBit's dark web affiliate panels exposed a rare glimpse into their operations. The leaked data included Bitcoin addresses, admin credentials, and a chat log revealing negotiation tactics and ransom demands. Ransom amounts varied widely, with some victims confused about the demands. The breach exposed LockBit's research into victims' finances and their willingness to provide additional services for a fee. The incident highlights the complexities of cybercrime negotiations and the human stories behind the headlines. Additionally, Cisco Talos observed a trend of attack kill chains being split into two stages, executed by separate threat actors, leading to refined definitions of initial access brokers.

The recent breach of LockBit's dark web affiliate panels has provided an unprecedented insight into the operational mechanics of one of the most prolific ransomware groups. LockBit operates on an affiliate model, where independent threat actors gain access to ransomware tools and infrastructure to conduct attacks, sharing profits with the core group. The leaked data includes Bitcoin addresses used for ransom payments, administrative credentials for affiliate panels, and chat logs revealing negotiation tactics and ransom demand strategies. These ransom demands vary widely, sometimes causing confusion among victims, indicating a flexible and complex negotiation process tailored to each victim's perceived ability to pay. The breach also exposed LockBit's internal research into victims' financial situations, suggesting a targeted approach to maximize ransom yields. Additionally, LockBit offers ancillary paid services such as data leak site management and victim support, reflecting a sophisticated criminal business model.

Cisco Talos has observed an evolution in ransomware operations, with attack kill chains being split into two stages executed by separate threat actors. This division refines the role of initial access brokers, who specialize in gaining network entry and then selling or handing off access to ransomware affiliates. This operational separation complicates detection and response efforts. The technical indicators provided, including multiple file hashes, can assist defenders in identifying related malware or tools used by LockBit affiliates. Overall, this breach sheds light on the human and operational complexities behind ransomware campaigns, emphasizing the importance of understanding adversary tactics beyond mere technical exploits.

Detailed information about Unfiltered look into LockBit’s operations. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'initial access brokers'

Filter Threats

Threats Tagged 'initial access brokers'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility