IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Ransomware hackers break off from Babuk to join a new group

New research shines a light on the fallout between criminals in the wake of the Colonial Pipeline attack

Security researchers have detailed the fallout between cyber criminals following the Colonial Pipeline and Kaseya attacks. The consequences of these debacles has resulted in the formation of a new ransomware gang called Groove.

Researchers said the catalyst for this was when popular cyber crime forums banned ransomware actors from advertising following the Colonial Pipeline attack. This made it harder for ransomware-as-a-service (RaaS) groups to establish credibility and maintain their current top tier position in the underground. 

After a tempestuous shutdown of Babuk and the aftermath following the Colonial Pipeline and Kaseya attacks, some of the ransomware-affiliated cybercriminals have found a home in a forum known as RAMP, according to a blog post by researchers at McAfee.

 The cyber crime forum’s name supposedly stands for “Ransom Anon Mark[et] Place”. RAMP was created in July 2021 by a threat actor TetyaSluha, who later changed their name to Orange. The forum provides coordination, communication, and organizational support for the top cyber extortionists.

“This actor claimed the forum would specifically cater to other ransomware-related threat actors after they were ousted from major cybercrime forums for being too toxic, following the high-profile ransomware attacks against the Colonial Pipeline and Washington D.C.’s Metropolitan Police Department in the spring of 2021,” said researchers.

Related Resource

The state of ransomware in retail 2021

Insights into the current state of ransomware in the retail sector

Whitepaper front coverFree download

Orange is thought to be a member of a new ransomware gang called Groove, according to research published by security firm Advanced Intel

Researchers said Groove is a novel ransomware group that became especially active in August and September 2021. Groove allegedly employs former Babuk developers and possesses advanced tactics and tools. 

“For instance, on September 7, 2021, the same day as the publication of the “Ransomware Thoughts” Groove released leaks of Fortinet VPN SSL credentials via their leak website. The list contains 799 directories and 86,941 purportedly compromised VPN connections. The reason behind the leak is unclear,” said researchers.

Researchers at Advanced Intel said as Groove and Babuk both continue to exist, “we are likely to see more drama coming our way.”

“This state of affairs demonstrates a complex ransomware ecosystem where new groups emerge as a result of the competition within larger gangs that fall apart and due to inner conflicts, while older groups attempt to rebrand in order to institutionalize the paradigms which they considered operationally existential,” they added. 

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022
CIAM buyer’s guide
Whitepaper

CIAM buyer’s guide

6 Jun 2022

Most Popular

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
The UK's best cities for tech workers in 2022
Business strategy

The UK's best cities for tech workers in 2022

24 Jun 2022
Carnival hit with $5 million fine over cyber security violations
cyber security

Carnival hit with $5 million fine over cyber security violations

27 Jun 2022