IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Criminals caught trying to recruit insiders to plant ransomware

Employees offered cut of proceeds if they deploy DemonWare on their behalf

Security researchers have discovered a new campaign where cyber criminals offer money to a victim organization’s staff to install ransomware on their behalf.

Researchers at Abnormal Security identified several emails criminals sent to their customers soliciting their help in an insider threat scheme. The aim was for them to infect their companies’ networks with ransomware. Researchers said the emails came from someone with ties to the DemonWare ransomware group.

The latest campaign, criminals told employees they would receive $1 million in Bitcoin — 40% of the presumed $2.5 million ransom — if they deployed ransomware on a company computer or Windows server.

“The employee is told they can launch the ransomware physically or remotely. The sender provided two methods to contact them if the employee is interested—an Outlook email account and a Telegram username,” said researchers.

Crane Hassold, director of threat intelligence with Abnormal Security, said to better understand what was happening, the firm set up a fictitious persona and contacted the hackers on Telegram to see if they could get a response. 

"It didn't take long for a response to come back, and the resulting conversation gave us an incredible inside look at the mindset of this threat actor."

"Based on our conversation with the actor, he claimed to have successfully deployed the ransomware against three companies; however, we haven't been able to verify his claims,” he added.

A half-hour later, the actor responded and asked whether the researcher, posing as a prospective accomplice, could access our fake company’s Windows server. The researcher affirmed this and was then sent two links for an executable file we could download on WeTransfer or Mega.nz, two file sharing sites.

Based on an analysis of the file, researchers confirmed the files were ransomware. Further investigation confirmed the hacker was Nigerian. The hacker also claimed to have developed the DemonWare ransomware, although researchers said all code for DemonWare is freely available on GitHub.

“In this case, our actor simply needed to download the ransomware from GitHub and socially engineer someone to deploy the malware for them,” said Hassold.

Related Resource

How to reduce the risk of phishing and ransomware

Top security concerns and tips for mitigation

Large letter 'O' against a background of a city - whitepaper from MimecastFree download

Hassold said knowing the hacker is Nigerian brings the entire story full circle and provides some notable context to the tactics used in the initial email identified.

“For decades, West African scammers, primarily located in Nigeria, have perfected the use of social engineering in cyber crime activity,” Hassold said.

“While the most common cyber attack we see from Nigerian actors (and most damaging attack globally) is business email compromise (BEC), it makes sense that a Nigerian actor would fall back on using similar social engineering techniques, even when attempting to successfully deploy a more technically sophisticated attack like ransomware,” Hassold added.

Featured Resources

The Total Economic Impact™ Of Turbonomic Application Resource Management for IBM Cloud® Paks

Business benefits and cost savings enabled by IBM Turbonomic Application Resource Management

Free Download

The Total Economic Impact™ of IBM Watson Assistant

Cost savings and business benefits enabled by Watson Assistant

Free Download

The field guide to application modernisation

Moving forward with your enterprise application portfolio

Free Download

AI for customer service

Discover the industry-leading AI platform that customers and employees want to use

Free Download

Recommended

Twilio account breach result of sophisticated social engineering campaign
Security

Twilio account breach result of sophisticated social engineering campaign

9 Aug 2022
Over 200,000 DrayTek routers vulnerable to total device takeover
Security

Over 200,000 DrayTek routers vulnerable to total device takeover

3 Aug 2022
Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Data on 69 million Neopets users stolen and listed for sale on hacker forum
Security

Data on 69 million Neopets users stolen and listed for sale on hacker forum

21 Jul 2022

Most Popular

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
The benefits of a hardware update for SMBs
Sponsored

The benefits of a hardware update for SMBs

2 Aug 2022