Hackers Impersonate as Security Researcher Aid Ransom Victims

Hackers impersonate security researchers to exploit trust and credibility. By posing as legitimate figures in the cybersecurity community, they:

• Gain access to sensitive information
• Manipulate victims into compromising actions
• Enhance the success of their malicious activities while evading suspicion

Cybersecurity researchers at Arctic Wolf Labs recently discovered that hackers are actively impersonating security researchers to aid ransomware victims.

Technical Analysis

Arctic Wolf Labs researchers found ransomware victims getting extorted again, with fake ‘helpers’ promising to delete stolen data. 

They posed as security researchers in two cases, offering to hack the original ransomware group’s servers. This is the first known case of a threat actor pretending to be a legitimate researcher and offering to delete hacked data from another ransomware group. 

Despite different personalities, the security analysts believe it’s likely the same actor behind both extortion attempts.

Despite appearing distinct, both cases share key elements. Analyzing their communication styles revealed clear similarities. 

Besides this, the unique aspects include the following:

• Low ransom demands
• Masquerading as a legit researcher
• Offering data deletion to prevent future attacks

Cases

Here below, we have mentioned the two cases that the cybersecurity researchers identified:

• Case 1 – Royal Ransomware Compromise and Ethical Side Group Data Deletion Extortion: In this case, the Ethical Side Group (ESG) told a Royal ransomware victim in October 2023 via email that they had victim data taken by Royal. In 2022, Royal said they deleted it, but ESG falsely blamed TommyLeaks. ESG offered to hack and delete the data from Royal’s server for a fee.

• Case 2 – Akira Ransomware Compromise and xanonymoux Data Deletion Extortion: In this case, an entity claiming to be “xanonymoux” told an Akira ransomware victim in November 2023 they had the exfiltrated data Akira denied having. That’s why xanonymoux offered its help to delete the data or grant server access, alleging Akira’s link to the Karakurt extortion group.

Common Threat Actor Behaviors

Here below, we have mentioned all the common threat actor behaviors:

• Acting in the role of a security researcher
• Defended the right to inspect the computer infrastructure that houses data compromised in the past
• Exchanged messages over Tox
• Provided as a means of establishing jurisdiction over stolen information
• Potential for such attacks in the future due to unresolved security concerns
• Quantity of data that was previously extracted
• Minimum required payment amount (<= 5 BTC)
• ten terms that appear in both the body of the email and the header
• Use of file.io to prove victim data access

Decrypting the complicated world of ransomware, RaaS affiliates juggle multiple encryption payloads. 

Uncertainty persists about group sanctioning in follow-on extortion. Beware of relying on criminal enterprises to delete data post-payment.

After analyzing the similarities found in the documented cases, Researchers reasonably conclude that a single threat actor has been targeting organizations previously affected by Royal and Akira ransomware attacks. This conclusion is made with a moderate level of confidence. Nevertheless, it remains uncertain if the original ransomware groups authorized the subsequent instances of extortion or if the threat actor operated independently to obtain more funds from the targeted organizations.

Secure Your Network with Network Security Checklist: Download Free E-Book