Why it matters: As ransomware remains a prevalent security threat, an essential step in countering attackers is identifying their methods. Security researchers found that several of the most prolific groups share a significant proportion of their tactics, potentially making them more predictable.

A new report from security company Kaspersky reveals that eight of the most active ransomware gangs operate with very similar patterns. Analysis, digital forensics specialists, and other security workers could use these similarities to identify and fight these attackers more efficiently.

The report analyzes the tactics, techniques, and procedures of (TTP) of the ransomware groups Conti/Ryuk, Pysa, Clop (TA505), Hive, Lockbit 2.0, RagnarLocker, BlackByte, and BlackCat. VentureBeat notes that these eight gangs have attacked over 500 organizations in various industries in the US, the UK, and Germany in the last year. Kaspersky built an interesting chart listing dozens of steps in ransomware attacks and indicating which attackers undergo each step. None of them are unique to one group.

Click on the image to view the full-size chart

For instance, all the groups like to start by attacking external remote services, while only half also open with phishing. All the gangs tend to favor targets like Windows Management Instrumentation, command and scripting interpreters, application layer protocols, web protocols, signed binary execution, and others.

Common steps like preventing system recovery or encrypting the most impactful data seem obvious. However, some of the least prevalent tactics involve BITS jobs, lifting account credentials from password stores, or getting them from web browsers.

Early in June, a Foxconn facility in Mexico suffered an attack from Lockbit 2.0. Other recent ransomware victims include QNAP, Asustor, and Nvidia.

Ruja Ignatova, who in the past dubbed herself the “Cryptoqueen,” is now sitting with a fancy crown in a new royal court: the FBI’s top 10 most wanted.

FBI officials and federal prosecutors announced Ignatova’s new designation in a press conference Thursday. Ignatova was charged in 2019 with wire fraud, securities fraud, and conspiracy to commit money laundering for her part in the OneCoin crypto company that prosecutors alleged was just a ponzi scheme.

Michael Driscoll, the FBI’s assistant director-in-charge for New York declined to answer Reuters’ questions whether they had any leads, but said Ignatova “left with a tremendous amount of cash,” adding, “money can buy a lot of friends.”

Ignatova was part of a Bulgaria-based crypto company called OneCoin. The company claimed they were performing a regular crypto mining operation—generating new tokens added to a blockchain—and pumped out $3.78 billion in revenue from the end of 2014 to the middle of 2016. But despite the upward momentum, investigators from the U.S. Department of Justice reported that OneCoin’s value was rigged internally, that the coins were essentially worthless, and users could not even trace ownership of the coins. The DOJ alleged those at the head of the company made nearly $2.5 billion in profit that they squirreled away in company bank accounts.

Damian Williams, the U.S. attorney for the Southern District of New York, told reporters Ignatova capitalized “on the frenzied speculation of the early days of cryptocurrency.”

In an FBI-provided video of Ignatova speaking at a London company event dated June, 2016, Ignatova boasted about her two million active users, adding “no other cryptocurrency has as many users as we do,”

Advertisement

Bloomberg reported that after Ignatov grew suspicious that the feds were onto her, she fled to Greece and then investigators lost track of her.

In 2019, the U.S. unsealed an indictment against Ignatov, charging her with the previously mentioned litany of financial crimes. That same year, Konstantin Ignatova, one of OneCoin’s founders and Ruja’s brother, was charged with conspiracy to commit wire fraud. Konstantin managed to get a plea deal, and though his sentencing was set for May 13, his attorneys adjourned the date for 90 days so he could further cooperate with authorities.

The Cryptoqueen has evaded police custody and remains at large to this day. So, the FBI says it’ll pay up to a $100,000 reward for any info that leads to an arrest.

In addition, U.S. prosecutors previously convicted former corporate lawyer Mark Scott of conspiracy to commit money laundering and conspiracy to commit bank fraud for laundering around $400 million for the company. Ruja Ignatov testified against Scott at his trial. Scott is contesting his guilty verdict by claiming Ruja lied on the stand, according to Bloomberg.