Ransomware hackers break off from Babuk to join a new group

New research shines a light on the fallout between criminals in the wake of the Colonial Pipeline attack

Security researchers have detailed the fallout between cyber criminals following the Colonial Pipeline and Kaseya attacks. The consequences of these debacles has resulted in the formation of a new ransomware gang called Groove.

Researchers said the catalyst for this was when popular cyber crime forums banned ransomware actors from advertising following the Colonial Pipeline attack. This made it harder for ransomware-as-a-service (RaaS) groups to establish credibility and maintain their current top tier position in the underground. 

After a tempestuous shutdown of Babuk and the aftermath following the Colonial Pipeline and Kaseya attacks, some of the ransomware-affiliated cybercriminals have found a home in a forum known as RAMP, according to a blog post by researchers at McAfee.

 The cyber crime forum’s name supposedly stands for “Ransom Anon Mark[et] Place”. RAMP was created in July 2021 by a threat actor TetyaSluha, who later changed their name to Orange. The forum provides coordination, communication, and organizational support for the top cyber extortionists.

“This actor claimed the forum would specifically cater to other ransomware-related threat actors after they were ousted from major cybercrime forums for being too toxic, following the high-profile ransomware attacks against the Colonial Pipeline and Washington D.C.’s Metropolitan Police Department in the spring of 2021,” said researchers.

Related Resource

The state of ransomware in retail 2021

Insights into the current state of ransomware in the retail sector

Whitepaper front coverFree download

Orange is thought to be a member of a new ransomware gang called Groove, according to research published by security firm Advanced Intel

Researchers said Groove is a novel ransomware group that became especially active in August and September 2021. Groove allegedly employs former Babuk developers and possesses advanced tactics and tools. 

“For instance, on September 7, 2021, the same day as the publication of the “Ransomware Thoughts” Groove released leaks of Fortinet VPN SSL credentials via their leak website. The list contains 799 directories and 86,941 purportedly compromised VPN connections. The reason behind the leak is unclear,” said researchers.

Researchers at Advanced Intel said as Groove and Babuk both continue to exist, “we are likely to see more drama coming our way.”

“This state of affairs demonstrates a complex ransomware ecosystem where new groups emerge as a result of the competition within larger gangs that fall apart and due to inner conflicts, while older groups attempt to rebrand in order to institutionalize the paradigms which they considered operationally existential,” they added. 

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Researchers disclose top flaws abused by ransomware gangs
ransomware

Researchers disclose top flaws abused by ransomware gangs

20 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021
How do hackers choose their targets?
hacking

How do hackers choose their targets?

17 Sep 2021
Owner of DDoS for hire sites found guilty of hacking offences
distributed denial of service (DDOS)

Owner of DDoS for hire sites found guilty of hacking offences

17 Sep 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Google takes down map showing homes of 111,000 Guntrader customers
data breaches

Google takes down map showing homes of 111,000 Guntrader customers

2 Sep 2021
Intuit plans end-to-end SMB platform after $12 billion Mailchimp acquisition
mergers and acquisitions

Intuit plans end-to-end SMB platform after $12 billion Mailchimp acquisition

14 Sep 2021