Why Ransomware Groups Are Rebranding Their Operations
In October 2020, the聽聽(OFAC)聽published聽an advisory that聽added a new dimension to the debate surrounding whether to pay ransomware attackers. The advisory noted that OFAC has designated ransomware attackers and other malicious actors under its cyber-related sanctions program and other sanctions frameworks. It clarified that OFAC may subsequently impose civil penalties on U.S. persons who violate those sanctions programs by making payments to designated individuals. In accordance with the strict liability of those programs, U.S. persons may incur a penalty even if they didn鈥檛 know or hadn鈥檛 reason to know that they were making a payment to a designated individual.听
OFAC鈥檚聽advisory聽gave the U.S. government another avenue by which it could raise聽the costs of fulfilling ransomware groups鈥 payment demands. Several months later, the聽U.S. government focused in on ransomware even further following the聽Colonial Pipeline incident.听Indeed,听DarkSide鈥檚聽disruption of a major pipeline attracted the attention of the FBI and the U.S. Cybersecurity & Infrastructure Security Agency (CISA), among other public entities. It was a short time later when the聽REvil聽ransomware group announced that聽DarkSide聽had closed its doors after someone had stolen access to its servers and made off with its profits.听
A Rebranding Wave聽
Taken together, OFAC鈥檚 announcement and the attention generated by the Colonial Pipeline incident made it more difficult for ransomware groups to continue doing business in their existing operations. This helps to explain why some ransomware gangs聽spent the summer of 2021 rebranding themselves.听Provided below are a few of those ransomware groups that assumed a different name聽to avoid sanctions and draw less attention to themselves:聽
Evil Corp聽Impersonates聽the聽Babuk聽Operation聽
In the beginning of June,听聽discovered a new ransomware sample called 鈥淧ayloadBIN.鈥 The computer self-help website assumed that the malware was related to the rebranded聽Babuk聽operation and that those attackers had lied about their聽. But after analyzing the malware, security researchers Fabian聽Wosar聽and Michael Gillespie confirmed that聽PayloadBIN聽was a rebranded version of Evil Corp鈥檚 ransomware operations.听Wosar聽noted to Bleeping Computer that Evil Corp had likely聽impersonated聽Babuk聽to masquerade as an unsanctioned ransomware group.听
DoppelPaymer聽Becomes Grief聽
Less than two months later,听聽wrote that聽DoppelPaymer聽ransomware activity聽had聽dropped in May 2021. The security firm reasoned that the聽DoppelPaymer聽gang might have decided to lay low following the Colonial Pipeline attack. Whatever the reason, the ransomware group used that聽break to rebrand itself as Grief.听Zscaler聽confirmed that the two threats are the same,听noting聽that a Grief sample compiled on May 17 still pointed to聽DoppelPaymer鈥檚聽ransom portal.听
BlackMatter聽Incorporates聽DarkSide,听REvil, and聽LockBit聽
Around the same time that news of Grief first emerged, The Record wrote that a new聽Ransomware-as-a-Service聽(RaaS) affiliate program called 鈥淏lackMatter鈥 had emerged. Those behind the operation told聽聽that it had 鈥渋ncorporated in itself the best features of聽DarkSide,听REvil, and聽LockBit.鈥澛燚arkSide聽went offline following the Colonial Pipeline incident, as discussed above, while the聽REvil聽group鈥檚 websites went dark shortly after the聽Kaseya supply chain attack.听LockBit聽is the only one of those three ransomware groups that鈥檚聽still in operation. (In fact, its attackers recently announced聽.)听
Synack聽Morphs into El聽Cometa聽
滨苍听, the聽SynAck聽ransomware gang released decryption keys for the victims that it had affected between July 2017 and 2021. The ransomware group was in the process of rebranding itself as El聽Cometa聽at the time of the release. A member of聽SynAck聽allegedly stole the decryption keys and then provided them to The Record.听
Ransomware Defense as an Ongoing Process聽
As the examples discussed above illustrate, ransomware groups will continue to try to evade the gaze of the U.S. government聽and聽perpetuate their malicious activities. That鈥檚 why organizations need to focus on preventing a ransomware infection as an ongoing process. One of the ways they can do that is by augmenting their ability to defend against email attacks,听one of the most common delivery vectors for ransomware.听