Security News > 2022 > May > Industrial Spy data extortion market gets into the ransomware game
The Industrial Spy data extortion marketplace has now launched its own ransomware operation, where they now also encrypt victim's devices.
Last month, we reported on a new data extortion marketplace called Industrial Spy that allowed threat actors, and possibly even business competitors, to purchase data stolen from companies.
BleepingComputer's tests showed that the Industrial Spy ransomware does indeed encrypt files, but unlike most other ransomware families, does not append a new extension to encrypted file's names, as shown below.
While encrypting files, the Industrial Spy ransomware will create the above ransom note named 'README.html' in every folder on the device.
Instead of linking to the Industrial Spy Tor site, it links to Cuba Ransomware's data leak site and uses the same file name, !! READ ME !!.
While this does not 100% tie the two groups together, it's very possible that the Industrial Spy threat actors simply used Cuba's information while testing the creation of their ransomware.