Ransomware hackers break off from Babuk to join a new group

Security researchers have detailed the fallout between cyber criminals following the Colonial Pipeline and Kaseya attacks. The consequences of these debacles has resulted in the formation of a new ransomware gang called Groove.

Researchers said the catalyst for this was when popular cyber crime forums banned ransomware actors from advertising following the Colonial Pipeline attack. This made it harder for ransomware-as-a-service (RaaS) groups to establish credibility and maintain their current top tier position in the underground.

After a tempestuous shutdown of Babuk and the aftermath following the Colonial Pipeline and Kaseya attacks, some of the ransomware-affiliated cybercriminals have found a home in a forum known as RAMP, according to a blog post by researchers at McAfee.

The cyber crime forum’s name supposedly stands for “Ransom Anon Mark[et] Place”. RAMP was created in July 2021 by a threat actor TetyaSluha, who later changed their name to Orange. The forum provides coordination, communication, and organizational support for the top cyber extortionists.

“This actor claimed the forum would specifically cater to other ransomware-related threat actors after they were ousted from major cybercrime forums for being too toxic, following the high-profile ransomware attacks against the Colonial Pipeline and Washington D.C.’s Metropolitan Police Department in the spring of 2021,” said researchers.

Orange is thought to be a member of a new ransomware gang called Groove, according to research published by security firm Advanced Intel.

Researchers said Groove is a novel ransomware group that became especially active in August and September 2021. Groove allegedly employs former Babuk developers and possesses advanced tactics and tools.

“For instance, on September 7, 2021, the same day as the publication of the “Ransomware Thoughts” Groove released leaks of Fortinet VPN SSL credentials via their leak website. The list contains 799 directories and 86,941 purportedly compromised VPN connections. The reason behind the leak is unclear,” said researchers.

Researchers at Advanced Intel said as Groove and Babuk both continue to exist, “we are likely to see more drama coming our way.”

“This state of affairs demonstrates a complex ransomware ecosystem where new groups emerge as a result of the competition within larger gangs that fall apart and due to inner conflicts, while older groups attempt to rebrand in order to institutionalize the paradigms which they considered operationally existential,” they added.