Security News > 2020 > September > Russian Hackers Target Russian Companies With Ransomware

A hacking group whose members are Russian speakers is targeting organizations in Russia and post-Soviet countries with ransomware, Group-IB's security researchers have discovered.

The adversary employs phishing as means to compromise enterprise networks, and has been observed impersonating the self-regulatory organization Mikrofinansirovaniye i Razvitiye; the Minsk Tractor Works plant in Belarus; a Russian metallurgical holding company; the Russian media group RBC; and a dental clinic, Group-IB explains.

In May, OldGremlin leveraged a fake email allegedly from a Russian RBC journalist that offered a bank employee an interview.

Roughly 250 malicious emails were sent to Russian companies in the financial and industrial sectors.

"OldGremlin is the only Russian-speaking ransomware operator that violates the unspoken rule about not working within Russia and post-Soviet countries. They carry out multistage targeted attacks on Russian companies and banks using sophisticated tactics and techniques similar to those employed by APT groups," Oleg Skulkin, senior digital forensics analyst at Group-IB, commented.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/-R7ixSWyBiw/russian-hackers-target-russian-companies-ransomware