{"id":39430,"date":"2021-02-04T14:00:06","date_gmt":"2021-02-04T14:00:06","guid":{"rendered":"http:\/\/1c2ae0eb-1cf8-45b0-a496-268ddc54c5a5"},"modified":"2021-02-04T14:00:06","modified_gmt":"2021-02-04T14:00:06","slug":"blockchain-transactions-confirm-murky-and-interconnected-ransomware-scene","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/blockchain-transactions-confirm-murky-and-interconnected-ransomware-scene\/","title":{"rendered":"Blockchain transactions confirm murky and interconnected ransomware scene"},"content":{"rendered":"
\"ransomware-partnership.jpg\"<\/span>
<\/span> Image: Geralt on Pixabay <\/span><\/figcaption><\/figure>\n

A report published today by blockchain investigations firm Chainalysis confirms that cybercrime groups engaging in ransomware attacks don’t operate in their own bubbles but often switch ransomware suppliers (RaaS services) in a search for better profits.<\/p>\n

The report analyzed how Bitcoin funds were transferred from victims to criminal groups, and how the money was divided among different parties involved in the ransomware attack, and how it was eventually laundered.<\/p>\n

But to understand these dynamics, a short intro into the current ransomware scene is needed. Today, the ransomware landscape is very similar to how modern businesses operate.<\/p>\n

There are coders who create and rent the actual ransomware strain via services called RaaS — or Ransomware-as-a-Service — similar to how most modern software is provided today.<\/p>\n

Some RaaS operators rent their ransomware to anyone who signs up, while others prefer to work with small groups of verified clients, which are usually called “affiliates.”<\/p>\n

The affiliates are the ones to usually spread the ransomware via email or orchestrate intrusions into corporate or government networks, which they later infect and encrypt with the ransomware they rented from the RaaS operator.<\/p>\n

In some cases, the affiliates are also multiple groups themselves. Some are specialized in breaching a company’s network perimeter, and are called initial access vendors, while some groups are specialized in expanding this initial access inside hacked networks to maximize the ransomware’s damage.<\/p>\n

<\/section>\n

All in all, the ransomware landscape has evolved from previous years and is now a collection of multiple criminal groups, each providing its own highly-specialized service to one another, often across different RaaS providers.<\/p>\n

BTC transactions show collaborations between criminal groups<\/h3>\n

The Chainalysis report<\/a> released today confirms these informal theories with undisputable and unforgeable cryptographic proof left behind by the Bitcoin transactions that have taken place among some of these groups.<\/p>\n

For example, based on the graph below, Chainalysis said it found evidence to suggest that an affiliate for the now-defunct Maze RaaS was also involved with SunCrypt RaaS.<\/p>\n

“We see that the Maze affiliate also sent funds \u2014 roughly 9.55 Bitcoin worth over $90,000 \u2014 via an intermediary wallet to an address labeled ‘Suspected SunCryptadmin,’ which we’ve identified as part of a wallet that has consolidated funds related to a few different SunCrypt attacks,” Chainalysis said.<\/p>\n

“This suggests that the Maze affiliate is also an affiliate for SunCrypt, or possibly involved with SunCrypt in another way.”<\/p>\n

\"ca-maze-suncrypt.png\"<\/span>