Security News > 2021 > August > FBI: OnePercent Group Ransomware targeted US orgs since Nov 2020
The Federal Bureau of Investigation has shared info about a threat actor known as OnePercent Group that has been actively targeting US organizations in ransomware attacks since at least November 2020.
"The FBI has learned of a cyber-criminal group who self identifies as the 'OnePercent Group' and who have used Cobalt Strike to perpetuate ransomware attacks against US companies since November 2020," the FBI said.
After maintaining access to their victims' networks for up to one month and exfiltrating files before deploying the ransomware payloads, OnePercent will encrypt files using a random eight-character extension and will add uniquely named ransom notes linking to the gang's.
According to the FBI, OnePercent Group threat actors will also reach out to their victims using spoofed phone numbers, threatening to leak the stolen data unless they're connected with a company negotiator.
"Once the ransomware is successfully deployed, the victim will start to receive phone calls through spoofed phone numbers with ransom demands and are provided a ProtonMail email address for further communication," the FBI added.
While the FBI hasn't provided any information on OnePercent Group's past attacks, two of the command-and-control servers mentioned in FBI's IOC list also shows up on FireEye's report on the UNC2198 threat actor who ICEDID to deploy Maze and Egregor ransomware.
News URL
Related news
- FBI: BlackSuit ransomware made over $500 million in ransom demands (source)
- FBI: BlackSuit ransomware behind over $500 million in ransom demands (source)
- FBI and CISA Warn of BlackSuit Ransomware That Demands Up to $500 Million (source)
- FBI disrupts the Dispossessor ransomware operation, seizes servers (source)
- FBI Shuts Down Dispossessor Ransomware Group's Servers Across U.S., U.K., and Germany (source)
- Ransom Cartel, Reveton ransomware owner arrested, charged in US (source)
- US accuses man of being 'elite' ransomware pioneer they've hunted for years (source)
- Alleged Karakut ransomware scumbag charged in US (source)
- US Marshals Service disputes ransomware gang's breach claims (source)
- FBI: RansomHub ransomware breached 210 victims since February (source)