{"id":46631,"date":"2022-05-13T15:43:11","date_gmt":"2022-05-13T15:43:11","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33443\/Ransomware-Operators-Send-Their-Ransom-Note-To-The-Victims-Printer.html"},"modified":"2022-05-13T15:43:11","modified_gmt":"2022-05-13T15:43:11","slug":"ransomware-operators-send-their-ransom-note-to-the-victims-printer","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/","title":{"rendered":"Ransomware Operators Send Their Ransom Note To The Victim&#8217;s Printer"},"content":{"rendered":"<div class=\"share-bar-wrapper\">\n<div class=\"full-byline\">\n<div class=\"author-avatars\"> <a rel=\"author\" class=\"thumb author-modal-open\" data-component=\"authorModal\" data-author-modal-options=\"{&quot;selector&quot;:&quot;danny-palmer-modal&quot;,&quot;hoverSelector&quot;:&quot;.full-byline&quot;}\" href=\"https:\/\/www.zdnet.com\/meet-the-team\/uk\/dannypalmerzdnet\/\"> <span class=\"img \"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/img\/resize\/d31db2eb85c51031247ce810263a83caae1ca2c5\/2020\/02\/06\/6f24b751-729c-4ed9-9fae-979667f1d3b3\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp\" class alt=\"Danny Palmer\" height=\"50\" width=\"50\"><\/span> <\/a> <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<p>An hacking group which conducts cyber espionage campaigns and ransomware attacks is targeting organisations in Europe and the United States.&nbsp;<\/p>\n<p><a href=\"https:\/\/www.secureworks.com\/blog\/cobalt-mirage-conducts-ransomware-operations-in-us\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Cybersecurity researchers at Secureworks<\/a> have detailed a string of cyber attacks involving <a href=\"https:\/\/www.zdnet.com\/article\/ransomware-an-executive-guide-to-one-of-the-biggest-menaces-on-the-web\/\" target=\"_blank\" rel=\"noopener\">ransomware<\/a> and data theft which took place in early 2022 to an Iranian hacking group they refer to as Cobalt Mirage \u2013 also known as&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/these-iranian-hackers-posed-as-academics-in-a-bid-to-steal-email-passwords\/\" target=\"_blank\" rel=\"noopener\">APT35, Charming Kitten<\/a>, <a href=\"https:\/\/www.cybereason.com\/blog\/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Phosphorus<\/a> and <a href=\"https:\/\/www.zdnet.com\/article\/these-iranian-hackers-posed-as-academics-in-a-bid-to-steal-email-passwords\/\" target=\"_blank\" rel=\"noopener\">TA453<\/a> by other research groups.&nbsp;<\/p>\n<p>Among the attacks is an incident targeting a US local government network in March 2022, which Secureworks researchers have attributed to Cobalt Mirage due to hallmarks of previously uncovered attacks by the group. &nbsp;<\/p>\n<p>These include exploiting the&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/squirrelwaffle-loader-leverages-microsoft-exchange-server-vulns-for-financial-fraud\/\" target=\"_blank\" rel=\"noopener\">ProxyShell vulnerabilities<\/a> to deploy Fast Reverse Proxy client (FRPC) and enable remote access to vulnerable systems, along with use of infrastructure that matches patterns associated with the threat group.&nbsp;<\/p>\n<p>While the initial means of compromise in this attack is still unclear, researchers note how the attackers likely exploited unpatched&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/log4j-flaw-thousands-of-applications-are-still-vulnerable-warn-security-researchers\/\" target=\"_blank\" rel=\"noopener\">Log4j vulnerabilities<\/a>&nbsp;despite a patch being available. There&#8217;s evidence that this initial exploitation may have occurred as early as January 2022.&nbsp;<\/p>\n<p>Most of the intrusion activity spanned a four-day period in March, with the key aim of the activity based around scanning the network and stealing data \u2013 researchers note that this is strange, as like other attacks detected during the period, the targets had no strategic or political value to Iran.&nbsp;<\/p>\n<p><strong>SEE:&nbsp;<\/strong><a href=\"http:\/\/www.zdnet.com\/topic\/a-winning-strategy-for-cybersecurity\/\" target=\"_blank\" rel=\"noopener\"><strong>A winning strategy for cybersecurity<\/strong><\/a><strong>&nbsp;(ZDNet special report)<\/strong><\/p>\n<p>After the March 2022 intrusion was detected and disrupted, no further malicious activity was observed.&nbsp;<\/p>\n<p>Researchers suggest that the main motivation behind this attack, and others is financial gain, but it&#8217;s unclear how exactly the attackers would look to profit from it.&nbsp;<\/p>\n<p>&#8220;While the threat actors appear to have had a reasonable level of success gaining initial access to a wide range of targets, their ability to capitalize on that access for financial gain or intelligence collection appears limited,&#8221; Secureworks Counter Threat Unit (CTU) researchers wrote in a blog post.&nbsp;<\/p>\n<p>No ransomware was deployed in the attack against the undisclosed US local government victim, but researchers note that Cobalt Mirage does engage in ransomware attacks \u2013 as another victim discovered in January described as a &#8216;a U.S. philanthropic organization&#8217;.&nbsp;<\/p>\n<p>According to Secureworks researchers who investigated the incident, attackers used ProxyShell and <a href=\"https:\/\/www.zdnet.com\/article\/everything-you-need-to-know-about-microsoft-exchange-server-hack\/\" target=\"_blank\" rel=\"noopener\">Microsoft Exhange vulnerabilities<\/a> to move around the network and remotely gain access to accounts, before eventually triggering a BitLocker ransomware attack.&nbsp;<\/p>\n<p>Unusually, the ransom note was sent to a printer on the network and printed out on paper, detailing an email address and contact details. While Cobalt Mirage has links to state-backed hacking operations, in this case, the ransomware is being deployed as a purely financially motivated attack. Ransomware ransom notes are more typically left either on screens or on servers.<\/p>\n<p>&#8220;The threat actors completed the attack with an unusual tactic of sending a ransom note to a local printer. The note includes a contact email address and Telegram account to discuss decryption and recovery. This approach suggests a small operation that relies on manual processes to map victims to the encryption keys used to lock their data,&#8221; the security researchers said.&nbsp;<\/p>\n<p>In both incidents detailed by researchers, attackers were able to gain access to networks by exploiting unpatched critical cybersecurity vulnerabilities. In order to protect networks against cyber attacks, it&#8217;s recommended that <a href=\"https:\/\/www.zdnet.com\/article\/this-one-change-could-protect-your-systems-from-attack-so-why-dont-more-companies-do-it\/\" target=\"_blank\" rel=\"noopener\">security patches are applied as quickly as possible<\/a> in order to prevent potential intruders exploiting known vulnerabilities.&nbsp;<\/p>\n<p>Researchers also recommend implementing <a href=\"https:\/\/www.zdnet.com\/article\/multi-factor-authentication-use-it-for-all-the-people-that-access-your-network-all-the-time\/\" target=\"_blank\" rel=\"noopener\">multi-factor authentication<\/a>, and <a href=\"https:\/\/www.zdnet.com\/article\/ransomware-even-when-the-attackers-are-in-your-network-its-not-too-late-to-fight-back\/\" target=\"_blank\" rel=\"noopener\">monitoring for unauthorised or suspicious use<\/a> of tools and file-sharing services&nbsp; which could indicate attackers are in the network.&nbsp;<\/p>\n<p><strong>MORE ON CYBERSECURITY<\/strong><\/p>\n<p> READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/33443\/Ransomware-Operators-Send-Their-Ransom-Note-To-The-Victims-Printer.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[8372],"class_list":["post-46631","post","type-post","status-publish","format-standard","hentry","category-cybersecurity-blogs","tag-headlinehackermalwarecybercrimefraudcryptography"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ransomware Operators Send Their Ransom Note To The Victim&#039;s Printer 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware Operators Send Their Ransom Note To The Victim&#039;s Printer 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-05-13T15:43:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/d31db2eb85c51031247ce810263a83caae1ca2c5\/2020\/02\/06\/6f24b751-729c-4ed9-9fae-979667f1d3b3\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ransomware Operators Send Their Ransom Note To The Victim&#8217;s Printer\",\"datePublished\":\"2022-05-13T15:43:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/\"},\"wordCount\":627,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/d31db2eb85c51031247ce810263a83caae1ca2c5\\\/2020\\\/02\\\/06\\\/6f24b751-729c-4ed9-9fae-979667f1d3b3\\\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp\",\"keywords\":[\"headline,hacker,malware,cybercrime,fraud,cryptography\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/\",\"name\":\"Ransomware Operators Send Their Ransom Note To The Victim's Printer 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/d31db2eb85c51031247ce810263a83caae1ca2c5\\\/2020\\\/02\\\/06\\\/6f24b751-729c-4ed9-9fae-979667f1d3b3\\\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp\",\"datePublished\":\"2022-05-13T15:43:11+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/d31db2eb85c51031247ce810263a83caae1ca2c5\\\/2020\\\/02\\\/06\\\/6f24b751-729c-4ed9-9fae-979667f1d3b3\\\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/d31db2eb85c51031247ce810263a83caae1ca2c5\\\/2020\\\/02\\\/06\\\/6f24b751-729c-4ed9-9fae-979667f1d3b3\\\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,malware,cybercrime,fraud,cryptography\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackermalwarecybercrimefraudcryptography\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Ransomware Operators Send Their Ransom Note To The Victim&#8217;s Printer\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware Operators Send Their Ransom Note To The Victim's Printer 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware Operators Send Their Ransom Note To The Victim's Printer 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-05-13T15:43:11+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/d31db2eb85c51031247ce810263a83caae1ca2c5\/2020\/02\/06\/6f24b751-729c-4ed9-9fae-979667f1d3b3\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ransomware Operators Send Their Ransom Note To The Victim&#8217;s Printer","datePublished":"2022-05-13T15:43:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/"},"wordCount":627,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/d31db2eb85c51031247ce810263a83caae1ca2c5\/2020\/02\/06\/6f24b751-729c-4ed9-9fae-979667f1d3b3\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp","keywords":["headline,hacker,malware,cybercrime,fraud,cryptography"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/","url":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/","name":"Ransomware Operators Send Their Ransom Note To The Victim's Printer 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/d31db2eb85c51031247ce810263a83caae1ca2c5\/2020\/02\/06\/6f24b751-729c-4ed9-9fae-979667f1d3b3\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp","datePublished":"2022-05-13T15:43:11+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/d31db2eb85c51031247ce810263a83caae1ca2c5\/2020\/02\/06\/6f24b751-729c-4ed9-9fae-979667f1d3b3\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/d31db2eb85c51031247ce810263a83caae1ca2c5\/2020\/02\/06\/6f24b751-729c-4ed9-9fae-979667f1d3b3\/dp-zdnet-headshot-feb-20201.jpg?width=50&amp;height=50&amp;fit=crop&amp;auto=webp"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-operators-send-their-ransom-note-to-the-victims-printer\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,malware,cybercrime,fraud,cryptography","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackermalwarecybercrimefraudcryptography\/"},{"@type":"ListItem","position":3,"name":"Ransomware Operators Send Their Ransom Note To The Victim&#8217;s Printer"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46631","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=46631"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46631\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=46631"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=46631"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=46631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}