Traditionally, risk actors weren’t eager to interact with journalists. They could have adopted press protection about themselves, in fact, however they not often courted such consideration; staying underneath the radar was often rather more necessary to them. The thought of attackers frequently placing out press releases and statements – not to mention giving detailed interviews and arguing with reporters – was absurd (even when they had been typically very prepared to publicly argue with one another).
After which got here the ransomware gangs.
Ransomware has modified many aspects of the risk panorama, however a key current improvement is its rising commoditization and professionalization. There’s ransomware-as-a-service; logos and branding (and even paying acolytes to get tattoos) and slick graphics on leak websites; outlined HR and Authorized roles; and bug bounty programmes. Accompanying all this – alongside the astronomical felony positive aspects and the distress heaped on innumerable victims – is a slew of media consideration, and an more and more media-savvy assortment of risk actors.
Removed from shying away from the press, as so many risk actors did up to now, some ransomware gangs have been fast to grab the alternatives it affords them. Now, risk actors write FAQs for journalists visiting their leak websites; encourage reporters to get in contact; give in-depth interviews; and recruit writers. Media engagement supplies ransomware gangs with each tactical and strategic benefits; it permits them to use stress to their victims, whereas additionally enabling them to form the narrative, inflate their very own notoriety and egos, and additional ‘mythologize’ themselves.
In fact, it’s not all the time a harmonious relationship. Not too long ago, we’ve seen a number of examples of ransomware actors disputing journalists’ protection of assaults, and making an attempt to right the report – typically throwing insults at particular reporters into the cut price. Whereas this has implications for the broader risk panorama, it additionally has ramifications for particular person targets. Along with coping with enterprise impacts, ransom calls for, and reputational fallout, organizations are actually pressured to look at as ransomware gangs scrap with the media within the public area – with each incident fuelling extra protection and including additional stress.
Sophos X-Ops carried out an investigation of a number of ransomware leak websites and underground felony boards to discover how ransomware gangs are looking for to leverage the media and management the narrative – thereby hacking not solely techniques and networks, but in addition the accompanying publicity.
A quick abstract of our findings:
- Ransomware gangs are conscious that their actions are thought of newsworthy, and can leverage media consideration each to bolster their very own ‘credibility’ and to exert additional stress on victims
- Menace actors are inviting and facilitating communications with journalists by way of FAQs, devoted personal PR channels, and notices on their leak websites
- Some ransomware gangs have given interviews to journalists, through which they supply a largely optimistic perspective of their actions – doubtlessly as a recruitment software
- Nonetheless, others have been extra hostile to what they see as inaccurate protection, and have insulted each publications and particular person journalists
- Some risk actors are more and more professionalizing their method to press and reputational administration: publishing so-called ‘press releases’; producing slick graphics and branding; and looking for to recruit English writers and audio system on felony boards
Our goals in publishing this piece are to discover how and to what extent ransomware gangs are rising their efforts on this space, and to counsel issues that the safety group and the media can do now to negate these efforts and deny ransomware gangs the oxygen of publicity they’re looking for:
- Chorus from participating with risk actors except it’s within the public curiosity or supplies actionable data and intelligence for defenders
- Present data solely to help defenders, and keep away from any glorification of risk actors
- Help journalists and researchers focused by attackers
- Keep away from naming or crediting risk actors except it’s purely factual and within the public curiosity
Leveraging the media
Ransomware gangs are very acutely aware that the press considers their actions newsworthy, and can typically hyperlink to current protection of themselves on their leak websites. This reinforces their ‘credentials’ as a real risk for the good thing about guests (together with reporters and new victims) – and, in some instances, is probably going an ego journey as effectively.
Determine 1: Vice Society thanks a particular journalist for an article through which it was a part of a ‘Prime 5’ of ransomware and malware teams in 2022
Determine 2: The Play ransomware group hyperlinks to a Darkish Studying article on its leak website
However some ransomware gangs aren’t content material with merely posting current protection; they’ll additionally actively solicit journalists.
Collaboration
The RansomHouse group, for instance, has a message on its leak website particularly geared toward journalists, through which it presents to share data on a ‘PR Telegram channel’ earlier than it’s formally revealed. It’s not alone on this; allegedly, the LockBit ransomware group communicates with journalists utilizing Tox, an encrypted messaging service (many ransomware gangs record their Tox ID on their leak websites).
Determine 3: An invite from RansomHouse
Determine 4: The RansomHouse PR Telegram channel
The 8Base leak website has an an identical message (as different researchers have famous, 8Base and RansomHouse share different similarities, together with their phrases of service and ransom notes).
Determine 5: 8Base’s message to journalists
Rhysida’s contact kind on its leak website addresses a number of teams of individuals. Apparently, journalists seem first on this record, earlier than ‘Recoveries’ (presumably referring to victims or individuals engaged on their behalf).
Determine 6: Rhysida’s contact kind
Over on the Snatch leak website, the risk actor maintains a “Public discover.” Of explicit be aware is quantity eight on this record: “Snatch is open to the [sic] collaboration with any media to make knowledge leakage conditions shared [sic] and visual to large [sic] vary of individuals.” And, as with Rhysida, journalists come earlier than sufferer negotiations on the record.
Determine 7: Snatch’s ‘Public discover’
On Vice Society’s leak website, the risk actor notes: “There are a lot of journalists asking questions on us and our assaults.” The message goes on to incorporate a full FAQ for reporters, together with a request for journalists to offer their identify and outlet, and particulars of questions the group received’t reply. Helpfully, for reporters with urgent deadlines, the risk actor additionally states that they struggle to reply to queries inside 24 hours – an instance {of professional} PR greatest apply, which demonstrates how necessary that is to the risk actor.
Determine 8: Vice Society’s FAQ for journalists
As famous earlier, a lot of that is probably executed for bragging rights and to bolster criminals’ credibility and notoriety (which, in flip, can not directly enhance the stress on victims). However some teams are extra specific; Dunghill Leak, for instance, warns victims that if they don’t pay, they are going to take a number of actions – together with sending knowledge to the media.
Determine 9: Dunghill Leak’s warning to victims, together with a risk to ship knowledge to the media
Whereas not inside the scope of this text, the final line is value noting as effectively: Dunghill threatens to “invite varied regulation corporations to take up a gaggle case.” Ransomware class motion lawsuits will not be unparalleled, and should turn into more and more widespread.
In the same vein, we noticed a person posting on a outstanding felony discussion board about an organization which had been the sufferer of a knowledge breach. The person acknowledged that negotiations had damaged down, and provided to offer “the complete negotiation exchanges” to “verified press or researchers” – and in addition famous that “for individuals who want to partake in litigation…you need to use the under snippet of the negotiations.” This is likely one of the methods through which ransomware actors are shifting their methods, utilizing multi-pronged weaponization (publicity, lawsuits, regulatory obligations) to exert additional stress on victims. For example, ALPHV/BlackCat lately reported a sufferer to the Securities and Alternate Fee (SEC) for not disclosing a breach – one thing which some commentators consider might turn into more and more widespread.
Determine 10: A put up on a felony discussion board, relating to a knowledge breach
Different ransomware gangs are very conscious that they will exert extra stress on victims by elevating the spectre of media curiosity. Our Managed Detection and Response (MDR) staff lately noticed ransom notes containing this risk from each Inc (“confidential knowledge…might be unfold out to individuals and the media”) and Royal (“anybody on the web from darknet criminals…journalists…and even your staff will be capable of see your inner documentation”).
Not all ransom notes point out the media, in fact, and plenty of ransomware gangs keep minimalist, bare-bones leak websites which merely record their victims, with no direct appeals to journalists. However others interact immediately with the media, within the type of interviews.
Interviews
A number of ransomware actors have given in-depth interviews to journalists and researchers. In 2021, the LockBit operators granted an interview to Russian OSINT, a YouTube and Telegram channel. The identical yr, an nameless REvil affiliate spoke to Lenta.ru, a Russian-language on-line journal. In 2022, Mikhail Matveev (a.ok.a. Wazawaka, a.ok.a. Babuk, a.ok.a. Orange), a ransomware actor and founding father of the RAMP ransomware discussion board, spoke intimately to The Report – and even offered an image of himself. And some weeks later, a founding member of LockBit spoke to vx-underground (through which they admitted that they personal three eating places in China and two in New York.
In most of those interviews, the risk actors appear to relish the chance to present insights into the ransomware ‘scene’, focus on the illicit fortunes they’ve amassed, and supply ‘thought management’ concerning the risk panorama and the safety business. Just one – the REvil affiliate – offers a largely detrimental depiction of the felony life (“…you might be afraid on a regular basis. You get up in worry, you go to mattress in worry, you conceal behind a masks and a hood in a retailer, you even conceal out of your spouse or girlfriend”).
So, along with the motivations we’ve already mentioned – notoriety, egotism, credibility, not directly rising stress on victims – an additional potential motive for engagement with the media is recruitment. By depicting ransomware exercise as a glamorous, rich enterprise (“the chief in monetization,” as Matveev places it), risk actors could possibly be attempting to draw extra members and associates.
Press releases and statements
A handful of ransomware teams difficulty what they name “press releases” – and the truth that they use this time period is telling in itself. Karakurt, for instance, maintains a separate web page for its press releases. Of the three at the moment revealed, one is a public announcement that the group is recruiting new members, and the others are about particular assaults. In each these latter instances, in line with Karakurt, negotiations broke down, and the so-called ‘press releases’ are actually thinly-veiled assaults on each organizations in an try to stress them into paying and/or trigger reputational harm.
Each these items, whereas containing the odd error or idiosyncratic phrasing, are written in remarkably fluent English. One, aping the type of real press releases, even incorporates a direct quote from “the Karakurt staff.”
Determine 11: Karakurt’s ‘Press Releases’ web page
In distinction, an instance of a press launch from the Snatch group is way much less fluent, and doesn’t deal with a particular sufferer. As an alternative, it’s geared toward correcting errors by journalists (one thing that we’ll focus on in additional element shortly).
Determine 12: An excerpt from Snatch’s ‘press launch’
This assertion ends with the next sentence: “We’re all the time open for cooperation and communication and you probably have any questions we’re able to reply them right here in our tg [Telegram] channel.”
An additional instance, this one from Royal (not formally titled as a press launch, however with the heading “FOR IMMEDIATE RELEASE”), proclaims that the group won’t publish knowledge from a particular sufferer (a college), however will as an alternative delete it “consistent with our stringent knowledge privateness requirements and as an indication of our unwavering dedication to moral knowledge administration.” Right here, the risk actor is arguably inviting a comparability between their very own proactive motion to ‘defend’ in opposition to the leak (for which they’re accountable) and the mishandling of ransomware incidents and delicate knowledge by some organizations – thereby aiming to painting itself as extra accountable {and professional} than a few of its victims.
Determine 13: A public assertion by the Royal ransomware group
What’s notably noteworthy right here is the language; a lot of the type and tone of this announcement shall be recognisable to anybody who’s handled press releases and public statements. For example: “the bedrock ideas upon which Royal Information Providers operates”; “At Royal Information Providers, we respect the sanctity of academic and healthcare companies”; “Transferring ahead, we purpose to…”.
It’s additionally value noting that Royal appears to be attempting to rebrand itself as a safety service (“Our staff of knowledge safety specialists will supply…a complete safety report, together with our greatest suggestions and mitigations…”). It has this in widespread with many different ransomware teams – who, in wholly unconvincing makes an attempt to painting themselves as forces for good, have referred to themselves as a “penetration testing service” (Cl0p); “trustworthy and easy pentesters” (8Base); or as conducting “a cybersecurity examine” (ALPHV/BlackCat).
Rebranding is one other PR tactic borrowed from professional business, and it’s not unreasonable to take a position that ransomware teams might step up this tactic sooner or later – maybe as a recruitment software, or to attempt to alleviate detrimental protection from the media and a spotlight from regulation enforcement.
Branding
Branding is massively necessary to ransomware gangs looking for press protection. Catchy names and slick graphics assist entice the eyes of journalists and readers – notably in the case of leak websites, as they’re the public-facing presences of those risk actors, and shall be incessantly visited by journalists, researchers, and victims. Take into account Akira, with its retro aesthetics and interactive terminal, or Donut Leaks, which has a frontpage graphic full with flickering neon indicators.
Determine 14: The Akira leak website
Determine 15: The Donut Leaks website
The LostTrust ransomware group (a potential rebrand of MetaEncryptor) is so patently conscious that its leak website is its level of contact with the broader world, that it opted for a press convention graphic on its homepage.
Determine 16: LostTrust’s leak website. Notice the blurb on the backside, which incorporates the warning that “each incident is notified to all potential press within the area” – echoing the warning from Dunghill Leak
On the opposite facet of the coin, one ransomware group – both fed up with this pattern, or getting performatively meta with it – determined to eschew a reputation and model altogether.
Determine 17: A ransomware group which refuses to present itself a reputation – resulting in it inevitably being named ‘NoName ransomware’
Refined branding isn’t unique to ransomware gangs, in fact, and speaks to a wider level concerning the rising professionalization throughout many classes of risk actor, as we famous in our 2023 Annual Menace Report. Trendy adverts for malware merchandise, for instance, are sometimes characterised by engaging graphics and high-quality design.
One outstanding felony discussion board – which beforehand ran common, well-established ‘analysis contests’ – even has its personal ezine, together with artwork, tutorials, and interviews with risk actors. An instance, maybe, of cybercriminals not solely participating with media shops, however creating their very own.
Determine 18: Artwork from an ezine produced by members of a felony discussion board
Recruitment
When a Ukrainian researcher leaked 1000’s of messages from contained in the Conti ransomware gang in March 2022, many had been stunned on the extent of group inside the group. It had a definite hierarchy and construction, very similar to a professional firm: bosses, sysadmins, builders, recruiters, HR, and Authorized. It paid salaries frequently, and set working hours and holidays. It even had bodily premises. However what’s notably fascinating within the context of this text is that Conti had at the very least one individual (and presumably as many as three) devoted to negotiating ransoms and writing ‘weblog posts’ for the leak website (a ‘weblog’ is a euphemism for an inventory of victims and their revealed knowledge). So the kinds of issues we’ve been discussing – responding to journalists, writing press releases, and so forth – will not be essentially simply cobbled collectively by hackers once they’re not busy hacking. Inside outstanding, well-established teams, they might effectively add as much as a full-time position – mirroring the state of affairs in know-how and safety corporations, with groups devoted to publicizing analysis and outcomes (Sophos X-Ops being an instance, if that’s not getting too meta).
Whereas many ransomware-related actions don’t require fluent English expertise, this sort of work does – particularly if risk actors are additionally going to be writing public statements. Such people must be recruited from someplace, and on felony boards, adverts for English audio system and writers (and, often, audio system of different languages) are pretty widespread. Many of those advertisements aren’t essentially for ransomware teams, in fact, however probably for social engineering/scamming/vishing campaigns.
Determine 19: An advert on a felony discussion board for “an excellent English caller.” This advert might be for some kind of rip-off marketing campaign
In different instances, the form of work being provided is much less clear, and requires writers moderately than audio system:
Determine 20: A person on a felony discussion board seeks a “Skilled English Author”
Determine 21: A job advert on a felony discussion board. Trans.: “We’re on the lookout for somebody who can write/edit English articles for the clearnet web site. In case you are , message me and we’ll focus on the main points. excessive paying job. the work shall be accomplished over a protracted time frame, 1-3 articles per day.” The identical person additionally marketed for a “journalist/author.”
In a very curious instance – albeit one not associated to the media – a person created a thread entitled: “Evaluation of economic and authorized vulnerabilities for negotiations”:
Determine 22: An excerpt from the person’s put up
In the identical thread, the person later added extra element – noting that different duties would come with (trans.) “add bigdata to the onion area”, and that “in case of breakdown of negotiations”, candidates would even be anticipated to carry out “evaluation of developments, analysis, advertising technique, prospects, and so on. for additional sale to rivals.”
Determine 23: Additional element from the identical person
We assess that that is probably an try to recruit somebody to assist extort corporations into paying a ransom, by discovering compromising data which risk actors might use to use stress throughout negotiations. Notice that the primary a part of the advert states “most often [this] doesn’t require the usage of software program”, implying that this isn’t a ‘conventional’ ransomware group utilizing encrypting malware.
Lastly, we additionally famous a number of cases of customers promoting their companies as translators, notably Russian to English and vice versa.
Determine 24: A person presents their companies as a translator
Whereas we didn’t discover any particular examples of risk actors making an attempt to recruit individuals with advertising/PR expertise, that is one thing we’re going to maintain a watch out for. Given the rising ‘celebrification’ of ransomware teams (see LockBit’s tattoo stunt and related developments) and the rebranding methods mentioned beforehand, it could solely be a matter of time earlier than criminals make extra concerted efforts to handle their public photos and take care of the rising quantities of media consideration they obtain.
When issues go flawed
We’ve famous that ransomware teams leverage the media in a variety of methods: referring to earlier protection on their leak websites; inviting questions from journalists; giving interviews; and utilizing the specter of publicity to coerce victims into paying ransoms. Nonetheless, as many public figures and firms have discovered to their value, relationships with the media will not be all the time affable. On a number of events, ransomware teams and different risk actors have criticized journalists for what they really feel is inaccurate or unfair protection.
The builders of WormGPT, for instance – a derivation of ChatGPT, provided on the market on felony marketplaces to be used by risk actors – shut their undertaking down, as a result of quantity of media scrutiny. In a discussion board put up, they acknowledged: “we’re more and more harmed by the media’s portrayal…Why do they try to tarnish our popularity on this method?”
Ransomware teams, alternatively, are usually extra aggressive of their rebuttals. ALPHV/BlackCat, as an illustration, revealed an article on its leak website entitled “Assertion on MGM Resorts Worldwide: Setting the report straight”, a 1,300-word put up through which it criticized a variety of shops for not checking sources and reporting incorrect data.
Determine 25: ALPHV/BlackCat criticizes an outlet for ‘false reporting’
Determine 26: ALPHV/BlackCat criticizes one other outlet for ‘false reporting’, whereas admitting that it beforehand falsely reported a supply of ‘false data’
The assertion goes on to assault a person journalist and a researcher, earlier than concluding: “we’ve not spoken with any journalists…We didn’t and most certainly received’t.” Apparently, then, that is an instance of a ransomware group not participating with the media – as an alternative attempting to regulate the narrative by presenting itself as the only real, dominant, voice of reality. (Most likely there are some energy dynamics at play right here, too, however digging into the psychology of ransomware actors is one thing we’re neither certified nor inclined to do.)
The Cl0p ransomware group tried to do one thing related throughout a rash of high-profile assaults earlier this yr, which leveraged a vulnerability within the MOVEit file-transfer system. In a put up on its leak website, it acknowledged that “all media talking about this are do [sic] what they all the time do. Present little reality in a giant lie.” Later, the group particularly known as out the BBC for “creating propaganda,” after Cl0p had emailed the BBC with data. Very like the ALPHV/BlackCat instance above, Cl0p is making an attempt to ‘set the report straight,’ correcting what it sees as inaccuracies in media protection and representing itself as the one authoritative supply of knowledge. The message to victims, researchers, and the broader public: don’t consider what you learn within the press; solely we’ve the true story.
Determine 27: The Cl0p ransomware gang calls out the BBC for ‘twisting’ data
An uneasy relationship
Cl0p isn’t alone in feeling mistrustful of journalists; it’s a standard sentiment on felony boards. Many risk actors – not simply ransomware teams – dislike the press, and a few non-ransomware criminals are skeptical of the connection between journalists and ransomware gangs:
Determine 28: A risk actor criticizes journalists for believing the “lies” of ransomware actors, and criticizes ransomware actors “who’re simply attempting to rip-off you [journalists] and chase affect.” Notice that the sentiment right here just isn’t dissimilar to that expressed by ALPHV/BlackCat and Cl0p within the earlier part
Simply as ransomware teams are acutely aware that their leak websites are frequented by journalists, so members of felony boards know that journalists have infiltrated their websites. Excessive-traffic threads about outstanding breaches and incidents will typically include feedback alongside the strains of ‘Right here come the reporters,’ which often descend into full-blown rants and insults.
Determine 29: A number of members of a felony discussion board insult journalists
Extra not often, risk actors will name out and/or assault particular person journalists, as within the ALPHV/BlackCat instance above. Whereas this hasn’t, to our information, escalated to direct threats, these reactions are probably designed to make the journalists in query really feel uncomfortable, and in some instances to trigger reputational harm – not all the time efficiently.
The identify and branding of the carding market Brian’s Membership, for instance, is predicated on safety journalist Brian Krebs. The location makes use of Krebs’ picture, first identify, and a play on his surname (‘Krabs’, or crabs, for ‘Krebs’), on each its homepage and inside the website itself.
Whereas this doesn’t appear to unduly concern Krebs (he mentions being “stunned and delighted” to obtain a reply from the Brian’s Membership admin after making an enquiry about the location being compromised; the admin’s reply started: “No. I’m the true Brian Krebs right here 😊”), different journalists won’t really feel fairly so relaxed on this state of affairs.
In fact, researchers will not be immune to those ways both, and are additionally typically topic to insults and threats on boards. The connection between risk actors and researchers is a complete different story, and out of scope for this text, however one instance is value noting. After publishing the primary a part of a three-part sequence on the inside workings of the LockBit gang, researcher Jon DiMaggio was alarmed to find that LockBit’s profile image on a outstanding felony discussion board had been modified to a photograph of himself.
After publication of the ultimate a part of the sequence, risk actors mentioned the report amongst themselves. One was dismissive (trans.: “These are simply the most recent guesses from one of many 1000’s of knowledge safety journalists who can solely guess and create ineffective clickbait content material”), to which the LockBit account replied: “you might be proper, every part is made up…[but] it doesn’t matter what Johnny says, I nonetheless love him, he’s my most devoted fan and follows each sneeze, turning any sneeze into an enormous sensation, an actual journalist.”
Determine 31: LockBit posts in a dialogue about DiMaggio’s experiences
So even LockBit – one of the vital outstanding ransomware gangs, which has devoted vital effort and time into cultivating its picture, professionalizing itself, and giving media interviews – is sceptical of journalists and their motivations.
Conclusion
The truth that some ransomware teams will eagerly solicit media protection and talk with journalists, regardless of being mistrustful and demanding of the press basically, is a contradiction which shall be acquainted to many public figures. In the identical approach, many journalists will acknowledge the sensation of getting qualms concerning the actions, ethics, and motivations of many public figures, whereas additionally figuring out that reporting on these figures is within the public curiosity.
And, prefer it or not, some ransomware actors are on their method to changing into public figures. Accordingly, they’re devoting an rising period of time to ‘managing the media.’ They’re conscious of protection about themselves, and publicly right inaccuracies and omissions. They encourage questions, and supply interviews. They’re acutely aware that cultivating media relationships is helpful for reaching their very own goals and refining their public picture.
That is, in some methods, distinctive to ransomware gangs. In contrast to just about all different sorts of risk – that are based mostly on going undetected for so long as potential, and ideally indefinitely – a ransomware marketing campaign should ultimately make itself identified to the sufferer, to demand a ransom. Leak websites have to be publicly obtainable, in order that the criminals can apply stress to victims and publish stolen knowledge. These components, and the explosive development of the ransomware risk, have led to a state of affairs the place risk actors, removed from shunning the more and more vibrant glare of the media highlight, acknowledge the potential to replicate and redirect it for their very own ends. They will leverage alternatives to immediately and not directly apply stress to victims; entice potential recruits; enhance their very own notoriety; handle their public picture; and form the narrative of assaults.
In the mean time, these developments are nascent. Whereas there’s actually an effort amongst some ransomware actors to mimic the environment friendly ‘PR machines’ of professional companies, their makes an attempt are sometimes crude and amateurish. Typically they appear extra of an afterthought than anything.
Nonetheless, there are indications that that is altering. Initiatives reminiscent of devoted PR Telegram channels, FAQs for journalists, and makes an attempt to recruit journalists/writers, might develop and evolve. And as with many features of ransomware – and the risk panorama basically – commodification and professionalization are on the rise. It might be a approach off, nevertheless it’s not unfeasible that sooner or later, ransomware teams might have devoted, full-time PR groups: copywriters, spokespeople, even picture consultants. This will likely present some ‘nice-to-haves’ for ransomware actors – inflating egos, bolstering recruitment efforts – however it can predominantly come right down to including to the already vital stress positioned on victims, and decreasing any stress on themselves from regulation enforcement or the felony group.
Within the meantime, it’s probably that ransomware teams will proceed to attempt to management the narratives round particular person assaults, as we’ve seen lately with Cl0p and ALPHV/BlackCat. We’ll be protecting a detailed eye on developments on this house.
Acknowledgments
Sophos X-Ops want to thank Colin Cowie of Sophos’ Managed Detection and Response (MDR) staff for his contribution to this text.
