Security News > 2022 > August > Ransomware gangs move to 'callback' social engineering attacks
At least three groups split from the Conti ransomware operation have adopted BazarCall phishing tactics as the primary method to gain initial access to a victim's network.
This allows the threat actors to deploy highly-targeted attacks that are more difficult to detect and stop because of the social engineering component.
Currently, there is evidence of three groups, all part of the former Conti ransomware operation, that used BazarCall or a version of those tactics: Silent Ransom Group, Quantum, and Roy/Zeon.
Starting April 2022, as Conti was shutting down, the BazarCall operators formed their own extortion group called Silent Ransom Group.
According to information from AdvIntel, Quantum ransomware operators were the main Conti subdivision, a group of highly-skilled hackers responsible for breaching the Costa Rica government.
Roy/Zeon is also the most adept at social engineering and very selective with their targets, choosing companies with a high annual revenue or from sensitive industries.
News URL
Related news
- Critical SonicWall SSLVPN bug exploited in ransomware attacks (source)
- NoName ransomware gang deploying RansomHub malware in recent attacks (source)
- Port of Seattle hit by Rhysida ransomware in August attack (source)
- Clever Social Engineering Attack Using Captchas (source)
- AutoCanada says ransomware attack "may" impact employee data (source)
- Microsoft Identifies Storm-0501 as Major Threat in Hybrid Cloud Ransomware Attacks (source)
- Embargo ransomware escalates attacks to cloud environments (source)
- JPCERT shares Windows Event Log tips to detect ransomware attacks (source)
- Ransomware attack forces UMC Health System to divert some patients (source)
- Underground ransomware claims attack on Casio, leaks stolen data (source)