IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Ransomware hackers break off from Babuk to join a new group

New research shines a light on the fallout between criminals in the wake of the Colonial Pipeline attack

Security researchers have detailed the fallout between cyber criminals following the Colonial Pipeline and Kaseya attacks. The consequences of these debacles has resulted in the formation of a new ransomware gang called Groove.

Researchers said the catalyst for this was when popular cyber crime forums banned ransomware actors from advertising following the Colonial Pipeline attack. This made it harder for ransomware-as-a-service (RaaS) groups to establish credibility and maintain their current top tier position in the underground. 

After a tempestuous shutdown of Babuk and the aftermath following the Colonial Pipeline and Kaseya attacks, some of the ransomware-affiliated cybercriminals have found a home in a forum known as RAMP, according to a blog post by researchers at McAfee.

 The cyber crime forum’s name supposedly stands for “Ransom Anon Mark[et] Place”. RAMP was created in July 2021 by a threat actor TetyaSluha, who later changed their name to Orange. The forum provides coordination, communication, and organizational support for the top cyber extortionists.

“This actor claimed the forum would specifically cater to other ransomware-related threat actors after they were ousted from major cybercrime forums for being too toxic, following the high-profile ransomware attacks against the Colonial Pipeline and Washington D.C.’s Metropolitan Police Department in the spring of 2021,” said researchers.

Related Resource

The state of ransomware in retail 2021

Insights into the current state of ransomware in the retail sector

Whitepaper front coverFree download

Orange is thought to be a member of a new ransomware gang called Groove, according to research published by security firm Advanced Intel

Researchers said Groove is a novel ransomware group that became especially active in August and September 2021. Groove allegedly employs former Babuk developers and possesses advanced tactics and tools. 

“For instance, on September 7, 2021, the same day as the publication of the “Ransomware Thoughts” Groove released leaks of Fortinet VPN SSL credentials via their leak website. The list contains 799 directories and 86,941 purportedly compromised VPN connections. The reason behind the leak is unclear,” said researchers.

Researchers at Advanced Intel said as Groove and Babuk both continue to exist, “we are likely to see more drama coming our way.”

“This state of affairs demonstrates a complex ransomware ecosystem where new groups emerge as a result of the competition within larger gangs that fall apart and due to inner conflicts, while older groups attempt to rebrand in order to institutionalize the paradigms which they considered operationally existential,” they added. 

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download

Recommended

2022 IBM's Security X-Force cloud threat landscape report
Whitepaper

2022 IBM's Security X-Force cloud threat landscape report

22 Nov 2022
2022 Magic quadrant for Security Information and Event Management (SIEM)
Whitepaper

2022 Magic quadrant for Security Information and Event Management (SIEM)

22 Nov 2022
Seven realities facing SMBs as they enter a future of increased cyber threats
Whitepaper

Seven realities facing SMBs as they enter a future of increased cyber threats

21 Nov 2022
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

14 Nov 2022

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

14 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation
cyber crime

Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation

25 Nov 2022