Security News > 2021 > August > FBI: OnePercent Group Ransomware targeted US orgs since Nov 2020
The Federal Bureau of Investigation has shared info about a threat actor known as OnePercent Group that has been actively targeting US organizations in ransomware attacks since at least November 2020.
"The FBI has learned of a cyber-criminal group who self identifies as the 'OnePercent Group' and who have used Cobalt Strike to perpetuate ransomware attacks against US companies since November 2020," the FBI said.
After maintaining access to their victims' networks for up to one month and exfiltrating files before deploying the ransomware payloads, OnePercent will encrypt files using a random eight-character extension and will add uniquely named ransom notes linking to the gang's.
According to the FBI, OnePercent Group threat actors will also reach out to their victims using spoofed phone numbers, threatening to leak the stolen data unless they're connected with a company negotiator.
"Once the ransomware is successfully deployed, the victim will start to receive phone calls through spoofed phone numbers with ransom demands and are provided a ProtonMail email address for further communication," the FBI added.
While the FBI hasn't provided any information on OnePercent Group's past attacks, two of the command-and-control servers mentioned in FBI's IOC list also shows up on FireEye's report on the UNC2198 threat actor who ICEDID to deploy Maze and Egregor ransomware.
News URL
Related news
- US charges operators of cryptomixers linked to ransomware gangs (source)
- FBI wipes Chinese PlugX malware from over 4,000 US computers (source)
- FBI deletes Chinese PlugX malware from thousands of US computers (source)
- All your 8Base are belong to us: Ransomware crew busted in global sting (source)
- FBI, Europol, and NCA Take Down 8Base Ransomware Data Leak and Negotiation Sites (source)
- US sanctions LockBit ransomware’s bulletproof hosting provider (source)
- US indicts 8Base ransomware operators for Phobos encryption attacks (source)
- US newspaper publisher uses linguistic gymnastics to avoid saying its outage was due to ransomware (source)
- CISA and FBI: Ghost ransomware breached orgs in 70 countries (source)