The ransomware industry surged in 2023 as it saw an alarming 55.5% increase in victims worldwide, reaching a staggering 4,368 cases.
 |
| Figure 1: Year over year victims per quarter |
The rollercoaster ride from explosive growth in 2021 to a momentary dip in 2022 was just a teaser—2023 roared back with the same fervor as 2021, propelling existing groups and ushering in a wave of formidable newcomers.
 |
| Figure 2: 2020-2023 ransomware victim count |
LockBit 3.0 maintained its number one spot with 1047 victims achieved through the Boeing attack, the Royal Mail Attack, and more. Alphv and Cl0p achieved far less success, with 445 and 384 victims attributed to them, respectively, in 2023.
 |
| Figure 3: Top 3 active ransomware groups in 2023 |
These 3 groups were heavy contributors to the boom in ransomware attacks in 2023, but they were not the sole groups responsible. Many attacks came from emerging ransomware gangs such as 8Base, Rhysida, 3AM, Malaslocker, BianLian, Play, Akira, and others.
Newcomers to the Ransomware Industry
At Cyberint, the research team is constantly researching the latest ransomware groups and analyzing them for potential impact. This blog will look at 3 new players in the industry, examine their impact in 2023 and delve into their TTPs.
To learn about other new players download the 2023 Ransomware Report here.
3AM Ransomware
A newly discovered ransomware strain named 3AM has emerged, but its usage has been limited so far. In 2023 they have only managed to impact 20+ organizations (mostly in the USA). However, they are gaining notoriety due to a ransomware affiliate who tried to deploy LockBit on a target's network switching to 3AM when LockBit was blocked.
New ransomware families appear frequently, and most disappear just as quickly or never manage to gain significant traction. However, the fact that 3AM was used as a fallback by a LockBit affiliate suggests that it may be of interest to attackers and could be seen again in the future.
Interestingly, 3AM is coded in Rust and appears to be an entirely new malware family. It follows a specific sequence: it attempts to halt multiple services on the compromised computer before initiating the file encryption process. After completing encryption, it tries to erase Volume Shadow (VSS) copies. Any potential links between its authors and known cybercrime organizations remain unclear.
 |
| Figure 4: 3AM Leaked Data |
The threat actor's suspicious activities commenced with the utilization of the gpresult command to extract policy settings enforced on the computer for a specific user. Subsequently, they executed various components of Cobalt Strike and made efforts to elevate privileges on the computer using PsExec.
Following this, the attackers conducted reconnaissance through commands such as whoami, netstat, quser, and net share. They also attempted to identify other servers for lateral movement using the quser and net view commands. In addition, they established a new user account to maintain persistence and employed the Wput tool to transfer the victims' files to their FTP server.
The utilization of the Yugeon Web Clicks script from 2004 may appear perplexing at first glance. It raises questions about why an emerging ransomware group would opt for such outdated technology. However, there are several potential reasons for this choice, including:
- Obscurity: Older scripts and technologies may not be as commonly recognized by modern security tools, reducing the likelihood of detection.
- Simplicity: Older scripts might provide straightforward functionality without the complexities often associated with modern counterparts, making deployment and management easier.
- Overconfidence: The group may possess a high level of confidence in their abilities and may not see the necessity of investing in more advanced technology, particularly for their website.
It's essential to note that this choice exposes the group to certain risks. Employing outdated technology with known vulnerabilities can render their operations vulnerable to external attacks, countermeasures, or potential sabotage by other threat actors.
The 3AM ransomware group's choice of employing an outdated PHP script is a testament to the unpredictable nature of cybercriminals. Despite their use of advanced ransomware strains for targeting organizations, their selection of backend technologies may be influenced by a combination of strategic considerations, convenience, and overconfidence. It underscores the importance for organizations to remain vigilant and adopt a holistic security approach, recognizing that threats can emerge from both state-of-the-art and antiquated technologies.
Known TTPs
| Tools | Tactics |
| Resource Development | T1650 - Acquire Access |
| Collection | T1560 - Archive Collected Data |
| Impact | T1565.001 - Stored Data Manipulation |
| Collection | T1532 - Archive Collected Data |
| Collection | T1005 - Data from Local System |
Rhysida Ransomware
The Rhysida ransomware group came into the spotlight in May/June 2023 when they launched a victim support chat portal accessible through their TOR (.onion) site. They claim to be a "Cybersecurity team" acting in their victims' best interests, targeting their systems and highlighting vulnerabilities.
In June, Rhysida drew attention after publicly disclosing stolen Chilean Arm documents from their data leak site. The group has since gained notoriety due to their attacks on healthcare institutions, including Prospect Medical Holdings., leading government agencies and cybersecurity firms to track them closely. They have targeted several high-profile entities, including the British Library, where they caused a major technology outage and sold stolen PII online, and Insomniac Games, a Sony-owned video game developer. They have demonstrated broad reach across diverse industries.
Known TTPs
| Tools | Tactics |
| Privilege Escalation | T1055.003 - Thread Execution Hijacking |
| Privilege Escalation | T1547.001 - Registry Run Keys / Startup Folder |
| Privilege Escalation | T1055 - Process Injection |
| Privilege Escalation | T1548.002 - Bypass User Account Control |
| Defense Evasion | T1036 - Masquerading |
| Defense Evasion | T1027.005 - Indicator Removal from Tools |
| Defense Evasion | T1027 - Obfuscated Files or Information |
| Defense Evasion | T1620 - Reflective Code Loading |
| Defense Evasion | T1564.004 - NTFS File Attributes |
| Defense Evasion | T1497-Virtualization/Sandbox Evasion |
| Defense Evasion | T1564 - Hide Artifacts |
| Discovery | T1083 - File and Directory Discovery |
| Discovery | T1010 - Application Window Discovery |
| Discovery | T1082 - System Information Discovery |
| Discovery | T1057 - Process Discovery |
| Discovery | T1518.001 - Security Software Discovery |
| Initial Access | T1566-Phishing |
| Collection | T1005 - Data from Local System |
| Collection | T1119 - Automated Collection |
| Resource Development | T1587 - Develop Capabilities |
| Resource Development | T1583-Acquire Infrastructure |
| Execution | T1129 - Shared Modules |
| Execution | T1059 - Command and Scripting Interpreter |
| Reconnaissance | T1595- Active Scanning |
| Reconnaissance | T1598-Phishing for Information |
The Akira Group
The Akira Group, was discovered in March 2023 and has claimed 81 victims to date. Preliminary research suggests a strong connection between the group and the notorious ransomware group, Conti. The leaking of Conti's source code has led to multiple threat actors utilizing Conti's code to construct or adapt their own, making it challenging to determine which groups have connections to Conti and which are just utilizing the leaked code.
However, Akira does provide certain telltale clues suggesting a connection to Conti, ranging from similarities in their approach to the disregard for the same file types and directories, as well as the incorporation of comparable functions. Furthermore, Akira utilizes the ChaCha algorithm for file encryption, implemented in a manner akin to Conti ransomware. Lastly, the individuals behind the Akira ransomware directed complete ransom payments to addresses associated with the Conti group.
Akira offers ransomware-as-a-service, affecting both Windows and Linux systems. They utilize their official DLS (data leak site) to publish information about their victims and updates regarding their activities. The threat actors primarily concentrate on the US, although they also target the UK, Australia, and other countries.
They exfiltrate and encrypt data to coerce victims into paying a double ransom, both to regain access and to restore their files. In almost all instances of intrusion, Akira has capitalized on compromised credentials to gain their initial foothold within the victim's environment. Interestingly, most of the targeted organizations had neglected to implement multi-factor authentication (MFA) for their VPNs. While the exact origin of these compromised credentials remains uncertain, there is a possibility that the threat actors procured access or credentials from the dark web.
Known TTPs
| Tools | Tactics |
| Exfiltration | T1567 - Exfiltration Over Web Service |
| Initial Access | T1566.001 - Spearphishing Attachment |
| Exfiltration | T1041 - Exfiltration Over C2 Channel |
| Exfiltration | T1537 - Transfer Data to Cloud Account |
| Collection | T1114.001 - Local Email Collection |
| Impact | T1486 - Data Encrypted for Impact |
| Initial Access | T1566.002 - Spearphishing Link |
| Execution | T1059.001 - PowerShell |
| Execution | T1569.002 - Service Execution |
| Discovery | T1016.001 - Internet Connection Discovery |
| Initial Access | T1078 - Valid Accounts |
| Privilege Escalation | T1078 - Valid Accounts |
| Defense Evasion | T1078 - Valid Accounts |
| Persistence | T1078 - Valid Accounts |
| Privilege Escalation | T1547.009 - Shortcut Modification |
| Persistence | T1547.009 - Shortcut Modification |
| Initial Access | T1190 - Exploit Public-Facing Application |
| Defense Evasion | T1027.001 - Binary Padding |
| Exfiltration | T1029 - Scheduled Transfer |
| Execution | T1059.003 - Windows Command Shell |
| Initial Access | T1195 - Supply Chain Compromise |
| Defense Evasion | T1036.005 - Match Legitimate Name or Location |
| Privilege Escalation | T1547.001 - Registry Run Keys / Startup Folder |
| Persistence | T1547.001 - Registry Run Keys / Startup Folder |
| Exfiltration | T1020 - Automated Exfiltration |
The ransomware industry is burgeoning, attracting new and bold groups seeking to make a name for themselves by developing high-quality ransomware services and tools. In 2024, Cyberint anticipates several of these newer groups to enhance their capabilities and emerge as dominant players in the industry alongside veteran groups like LockBit 3.0, Cl0p, and AlphV.
Read Cyberint's 2023 Ransomware Report for the top targeted industries and countries, a breakdown of the top 3 ransomware groups, ransomware families worth noting, newcomers to the industry, notable 2023 campaigns, and 2024 forecasts.
