Security company Group-IB says it has spotted a new cybercrime group that has repeatedly and deliberately targeted various Russian companies with malware and ransomware attacks over the past six months. Group-IB says OldGremlin hackers are behind targeted attacks and are using a ransomware strain called TinyCryptor (also known as decr1pt).
"Only Russian companies have tried to target so far," Oleg Skulkin, senior Group-IB DFIR analyst, told ZDNet this week.
"It's very unusual for Russian-speaking gangs to have this unspecified rule not to target her Russia and the post-Soviet countries ”.
How the attacks unfold
OldGremlin attacks usually start with phear-phishing emails that carry ZIP files with malware, which will usually infect the body with a trojan backdoor called TinyNode. This gives the intruders a starting point network of the company, where hackers spread sideways to others systems and then develop ransomware in the final stages of their attacks.
Once a network is encrypted, the OldGremlin crew typically asks for about $ 50.000 ransom using messages left on the infected systems.
Skulkin says Group-IB spotted OldGremlin in August, but the group's attacks date back to March, with messages Phishing they use to have a variety of lures - for example they pretend to be themselves journalists looking for work.
As Skulkin noted, attacks on Russian entities are rare but have occurred in the past. Usually, groups like Silence and Cobalt started as "small" in Russia before expanding their activities abroad, first to neighboring countries and then to targets worldwide.
"If they are Russian, then it would be unusual, but not unheard of," KELA product manager Raveed Laeb told ZDNet in an interview this week.
"There is also the possibility that they are not Russians but operate outside the CIS countries - for example, Ukrainian nationals may have a dual motive for attacking Russian entities, both economic and ideological," Laeb added.
Greek
Chinese (Simplified)
English
Greek
Russian