Ransomware Notes Show Shift Toward ProtonMail and Tutanota, DarkOwl Analysis Finds
Summary
DarkOwl analyzed ransomware notes from 2016 through the first half of 2021 and found ProtonMail and Tutanota increasingly prominent. It predicts fewer email contacts in 2021 as groups use Telegram and Tor-hosted chats.
Key points
- DarkOwl says it reviewed ransomware notes collected from multiple darknet sources from 2016 through the first two quarters of 2021.
- The analysis reports that ProtonMail and Tutanota were preferred over other email services from 2019 onward.
- AOL and India.com were more popular in 2016 and 2017, while Gmail use remained consistent, according to the article.
- Tutanota appeared more frequently than ProtonMail in notes from the first half of 2021.
- DarkOwl predicted fewer email addresses in ransomware victim notes for 2021, citing groups’ use of Telegram and Tor-hosted chats for negotiations.
Article Details
- Publisher
- DarkOwl
- Report Period
- 2016 through the first two quarters of 2021
- Scope
- Email domains mentioned in ransomware notes harvested from multiple darknet sources
Vendors
AOLE-mail service providers AOL and India.com were most popular in 2016 and 2017 but use of these providers have dropped off considerably in recent years.GoogleGoogle’s Gmail has experienced moderate, alibeit consistent use by many ransomware criminal groups.India.comE-mail service providers AOL and India.com were most popular in 2016 and 2017 but use of these providers have dropped off considerably in recent years.Proton MailSince 2019, ransomware criminal gangs prefer the Swiss-based Protonmail and German-based Tutanota encrypted e-mail services over other e-mail service providers.TutanotaSince 2019, ransomware criminal gangs prefer the Swiss-based Protonmail and German-based Tutanota encrypted e-mail services over other e-mail service providers.
Products
AOLE-mail service providers AOL and India.com were most popular in 2016 and 2017 but use of these providers have dropped off considerably in recent years.GmailGoogle’s Gmail has experienced moderate, alibeit consistent use by many ransomware criminal groups.India.comE-mail service providers AOL and India.com were most popular in 2016 and 2017 but use of these providers have dropped off considerably in recent years.ProtonmailSince 2019, ransomware criminal gangs prefer the Swiss-based Protonmail and German-based Tutanota encrypted e-mail services over other e-mail service providers.TutanotaSince 2019, ransomware criminal gangs prefer the Swiss-based Protonmail and German-based Tutanota encrypted e-mail services over other e-mail service providers.