The ransomware industry surged in 2023 as it saw an alarming 55.5% increase in victims worldwide, reaching a staggering 4,368 cases.
Figure 1: Year over year victims per quarter
The rollercoaster ride from explosive growth in 2021 to a momentary dip in 2022 was just a teaser—2023 roared back with the same fervor as 2021, propelling existing groups and ushering in a wave of formidable newcomers.
Figure 2: 2020-2023 ransomware victim count
LockBit 3.0 maintained its number one spot with 1047 victims achieved through the Boeing attack, the Royal Mail Attack, and more. Alphv and Cl0p achieved far less success, with 445 and 384 victims attributed to them, respectively, in 2023.
Figure 3: Top 3 active ransomware groups in 2023
These 3 groups were heavy contributors to the boom in ransomware attacks in 2023, but they were not the sole groups responsible. Many attacks came from emerging ransomware gangs such as 8Base, Rhysida, 3AM, Malaslocker, BianLian, Play, Akira, and others.
At Cyberint, the research team is constantly researching the latest ransomware groups and analyzing them for potential impact. This blog will look at 3 new players in the industry, examine their impact in 2023 and delve into their TTPs.
To learn about other new players download the 2023 Ransomware Report here.
3AM Ransomware
A newly discovered ransomware strain named 3AM has emerged, but its usage has been limited so far. In 2023 they have only managed to impact 20+ organizations (mostly in the USA). However, they are gaining notoriety due to a ransomware affiliate who tried to deploy LockBit on a target’s network switching to 3AM when LockBit was blocked.
New ransomware families appear frequently, and most disappear just as quickly or never manage to gain significant traction. However, the fact that 3AM was used as a fallback by a LockBit affiliate suggests that it may be of interest to attackers and could be seen again in the future.
Interestingly, 3AM is coded in Rust and appears to be an entirely new malware family. It follows a specific sequence: it attempts to halt multiple services on the compromised computer before initiating the file encryption process. After completing encryption, it tries to erase Volume Shadow (VSS) copies. Any potential links between its authors and known cybercrime organizations remain unclear.
The threat actor’s suspicious activities commenced with the utilization of the gpresult command to extract policy settings enforced on the computer for a specific user. Subsequently, they executed various components of Cobalt Strike and made efforts to elevate privileges on the computer using PsExec.
Following this, the attackers conducted reconnaissance through commands such as whoami, netstat, quser, and net share. They also attempted to identify other servers for lateral movement using the quser and net view commands. In addition, they established a new user account to maintain persistence and employed the Wput tool to transfer the victims’ files to their FTP server.
The utilization of the Yugeon Web Clicks script from 2004 may appear perplexing at first glance. It raises questions about why an emerging ransomware group would opt for such outdated technology. However, there are several potential reasons for this choice, including:
Obscurity: Older scripts and technologies may not be as commonly recognized by modern security tools, reducing the likelihood of detection.
Simplicity: Older scripts might provide straightforward functionality without the complexities often associated with modern counterparts, making deployment and management easier.
Overconfidence: The group may possess a high level of confidence in their abilities and may not see the necessity of investing in more advanced technology, particularly for their website.
It’s essential to note that this choice exposes the group to certain risks. Employing outdated technology with known vulnerabilities can render their operations vulnerable to external attacks, countermeasures, or potential sabotage by other threat actors.
The 3AM ransomware group’s choice of employing an outdated PHP script is a testament to the unpredictable nature of cybercriminals. Despite their use of advanced ransomware strains for targeting organizations, their selection of backend technologies may be influenced by a combination of strategic considerations, convenience, and overconfidence. It underscores the importance for organizations to remain vigilant and adopt a holistic security approach, recognizing that threats can emerge from both state-of-the-art and antiquated technologies.
Known TTPs
Tools Tactics Resource Development T1650 – Acquire Access Collection T1560 – Archive Collected Data Impact T1565.001 – Stored Data Manipulation Collection T1532 – Archive Collected Data Collection T1005 – Data from Local System
Rhysida Ransomware
The Rhysida ransomware group came into the spotlight in May/June 2023 when they launched a victim support chat portal accessible through their TOR (.onion) site. They claim to be a “Cybersecurity team” acting in their victims’ best interests, targeting their systems and highlighting vulnerabilities.
In June, Rhysida drew attention after publicly disclosing stolen Chilean Arm documents from their data leak site. The group has since gained notoriety due to their attacks on healthcare institutions, including Prospect Medical Holdings., leading government agencies and cybersecurity firms to track them closely. They have targeted several high-profile entities, including the British Library, where they caused a major technology outage and sold stolen PII online, and Insomniac Games, a Sony-owned video game developer. They have demonstrated broad reach across diverse industries.
Known TTPs
ToolsTacticsPrivilege EscalationT1055.003 – Thread Execution HijackingPrivilege EscalationT1547.001 – Registry Run Keys / Startup FolderPrivilege EscalationT1055 – Process InjectionPrivilege EscalationT1548.002 – Bypass User Account ControlDefense EvasionT1036 – MasqueradingDefense EvasionT1027.005 – Indicator Removal from ToolsDefense EvasionT1027 – Obfuscated Files or InformationDefense EvasionT1620 – Reflective Code LoadingDefense EvasionT1564.004 – NTFS File AttributesDefense EvasionT1497-Virtualization/Sandbox EvasionDefense EvasionT1564 – Hide ArtifactsDiscoveryT1083 – File and Directory DiscoveryDiscoveryT1010 – Application Window DiscoveryDiscoveryT1082 – System Information DiscoveryDiscoveryT1057 – Process DiscoveryDiscoveryT1518.001 – Security Software DiscoveryInitial AccessT1566-PhishingCollectionT1005 – Data from Local SystemCollectionT1119 – Automated CollectionResource DevelopmentT1587 – Develop CapabilitiesResource DevelopmentT1583-Acquire InfrastructureExecutionT1129 – Shared ModulesExecutionT1059 – Command and Scripting InterpreterReconnaissanceT1595- Active ScanningReconnaissanceT1598-Phishing for Information
The Akira Group
The Akira Group, was discovered in March 2023 and has claimed 81 victims to date. Preliminary research suggests a strong connection between the group and the notorious ransomware group, Conti. The leaking of Conti’s source code has led to multiple threat actors utilizing Conti’s code to construct or adapt their own, making it challenging to determine which groups have connections to Conti and which are just utilizing the leaked code.
However, Akira does provide certain telltale clues suggesting a connection to Conti, ranging from similarities in their approach to the disregard for the same file types and directories, as well as the incorporation of comparable functions. Furthermore, Akira utilizes the ChaCha algorithm for file encryption, implemented in a manner akin to Conti ransomware. Lastly, the individuals behind the Akira ransomware directed complete ransom payments to addresses associated with the Conti group.
Akira offers ransomware-as-a-service, affecting both Windows and Linux systems. They utilize their official DLS (data leak site) to publish information about their victims and updates regarding their activities. The threat actors primarily concentrate on the US, although they also target the UK, Australia, and other countries.
They exfiltrate and encrypt data to coerce victims into paying a double ransom, both to regain access and to restore their files. In almost all instances of intrusion, Akira has capitalized on compromised credentials to gain their initial foothold within the victim’s environment. Interestingly, most of the targeted organizations had neglected to implement multi-factor authentication (MFA) for their VPNs. While the exact origin of these compromised credentials remains uncertain, there is a possibility that the threat actors procured access or credentials from the dark web.
Known TTPs
Tools Tactics Exfiltration T1567 – Exfiltration Over Web Service Initial Access T1566.001 – Spearphishing Attachment Exfiltration T1041 – Exfiltration Over C2 Channel Exfiltration T1537 – Transfer Data to Cloud Account Collection T1114.001 – Local Email Collection Impact T1486 – Data Encrypted for Impact Initial Access T1566.002 – Spearphishing Link Execution T1059.001 – PowerShell ExecutionT1569.002 – Service ExecutionDiscoveryT1016.001 – Internet Connection DiscoveryInitial AccessT1078 – Valid AccountsPrivilege EscalationT1078 – Valid AccountsDefense EvasionT1078 – Valid AccountsPersistenceT1078 – Valid AccountsPrivilege EscalationT1547.009 – Shortcut ModificationPersistenceT1547.009 – Shortcut ModificationInitial AccessT1190 – Exploit Public-Facing ApplicationDefense EvasionT1027.001 – Binary PaddingExfiltrationT1029 – Scheduled TransferExecutionT1059.003 – Windows Command ShellInitial AccessT1195 – Supply Chain CompromiseDefense EvasionT1036.005 – Match Legitimate Name or LocationPrivilege EscalationT1547.001 – Registry Run Keys / Startup FolderPersistenceT1547.001 – Registry Run Keys / Startup FolderExfiltrationT1020 – Automated Exfiltration
The ransomware industry is burgeoning, attracting new and bold groups seeking to make a name for themselves by developing high-quality ransomware services and tools. In 2024, Cyberint anticipates several of these newer groups to enhance their capabilities and emerge as dominant players in the industry alongside veteran groups like LockBit 3.0, Cl0p, and AlphV.
Read Cyberint’s 2023 Ransomware Report for the top targeted industries and countries, a breakdown of the top 3 ransomware groups, ransomware families worth noting, newcomers to the industry, notable 2023 campaigns, and 2024 forecasts.
Read the report to gain detailed insights and more.
Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.
