Ransomware Activity Shifts After Ukraine Invasion, DarkOwl Review Finds
Summary
DarkOwl’s review found Conti and LockBit 2.0 led reported victim counts after February 24, 2022; it also described activity by Pandora, STORMOUS and LAPSUS$, and noted geographic patterns in reported victims.
Key points
- DarkOwl reported that Conti and LockBit 2.0 led the number of victims announced since February 24, 2022.
- Conti reportedly paused activity for nearly a week amid infrastructure leaks and divisions with Ukrainian-aligned affiliates, then resumed attacks from March 1.
- DarkOwl said Pay2Key, Blackbyte and Cuba services were online but had not shared victim data since the invasion.
- The review said the newly identified Pandora Gang hit multiple victims within days, including two in Japan; STORMOUS was heavily targeting Ukraine.
- DarkOwl said LAPSUS$ solicited industry experts who might help select future victims, and implied responsibility for a recent Ubisoft cybersecurity incident.
- The United States, Canada, the United Kingdom, Czech Republic and Germany had the highest reported victim volumes in the review’s two-week geographic distribution.
- The review excluded Russian attacks on Ukrainian networks and leaks released by Free Civilian; DarkOwl said it would continue monitoring activity.
Article Details
- Event Type
- Ransomware-group activity following the invasion of Ukraine
- Impact
- DarkOwl reported changes in ransomware activity and victim disclosures after the invasion. Conti and Lockbit 2.0 led in announced victims; Conti briefly went offline before resuming attacks. Pandora Gang reportedly hit multiple victims, including two in Japan, while STORMOUS targeted Ukraine and reportedly attacked 4A Games and EPIC Games. LAPSUS$ was reported to have attacked Nvidia and SAMSUNG and implied responsibility for a recent Ubisoft cybersecurity incident. The article also noted that several groups had not shared victim data since the invasion.
Threat Actors
BlackByteRaaS gang whose Tor services were reported online and active, but with no victim data shared since the invasion.ContiRansomware group reported to have resumed locking and leaking victims’ networks after a brief period offline.CubaRaaS gang whose Tor services were reported online and active, but with no victim data shared since the invasion.LAPSUS$Cybercriminal group reported to have attacked Nvidia and SAMSUNG, solicited industry experts who might assist with victim selection, and implied responsibility for a Ubisoft cybersecurity incident.Lockbit 2.0Ransomware group reported among those with the highest number of announced victims since February 24, 2022.Pandora GangNew RaaS group reported to have hit multiple victims in a matter of days, including two in Japan.Pay2KeyRaaS gang whose Tor services were reported online and active, but with no victim data shared since the invasion.StormousRansomware group reported to have heavily targeted Ukraine and attacked 4A Games and EPIC Games.
Malware
Countries
CanadaUS, Canada, UK, Czech Republic, and Germany have the highest volume of ransomware victims in the distribution of victims by location published in the last two weeks.Czech RepublicUS, Canada, UK, Czech Republic, and Germany have the highest volume of ransomware victims in the distribution of victims by location published in the last two weeks.GermanyUS, Canada, UK, Czech Republic, and Germany have the highest volume of ransomware victims in the distribution of victims by location published in the last two weeks.JapanA new RaaS group called Pandora Gang hit multiple victims in a matter of days, including two victims from Japan.Ukrainedid a cursory review of activity across ransomware-as-a-service (RaaS) gangs since the invasion of Ukraine.United KingdomUS, Canada, UK, Czech Republic, and Germany have the highest volume of ransomware victims in the distribution of victims by location published in the last two weeks.United StatesSTORMOUS most recently attacked 4A Games (Ukraine) and EPIC Games (US).
Industries
Call-centersTelecommunications, software development/gaming, hosting, and call-centers were among the industries requested.GamingTelecommunications, software development/gaming, hosting, and call-centers were among the industries requested.hostingTelecommunications, software development/gaming, hosting, and call-centers were among the industries requested.Software developmentTelecommunications, software development/gaming, hosting, and call-centers were among the industries requested.TelecommunicationsTelecommunications, software development/gaming, hosting, and call-centers were among the industries requested.