{"id":53374,"date":"2023-08-24T18:39:00","date_gmt":"2023-08-24T18:39:00","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals"},"modified":"2023-08-24T18:39:00","modified_gmt":"2023-08-24T18:39:00","slug":"ransomware-with-an-identity-crisis-targets-small-businesses-individuals","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/","title":{"rendered":"Ransomware With an Identity Crisis Targets Small Businesses, Individuals"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt706c564215e69a0c\/64e650eeb6ccf844b5e28aac\/Ransomware_Zoonar_GmbH_Alamy.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>Researchers have identified a new strain of <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/ransomware-reaches-new-heights\" target=\"_blank\" rel=\"noopener\">ransomware<\/a> that dates back to 2019 and targets individuals and small businesses, demanding small ransoms from each client rather than the often million-dollar sums that typical ransomware actors ask.<\/p>\n<p>TZW is the latest strain of the Adhubllka ransomware family, which first appeared in January 2020 but already was active the year before, researchers from security and operations analytics firm Netenrich revealed in a blog post published this week.<\/p>\n<p>Even more important than the discovery of the strain is the process that researchers undertook to identify it correctly. Over the years, many of the samples of Adhubllka have been misclassified and\/or mistagged into some other ransomware family, says Rakesh Krishnan, senior threat analyst at Netenrich.<\/p>\n<p>&#8220;This would confuse threat hunters\/security researchers while doing an incident report,&#8221; he says. Indeed, researchers report that multiple engines had previously detected TZW but found traces of other malware, such as CryptoLocker, in the sample.<\/p>\n<p>Further, other names had already been assigned to the same piece, including ReadMe, MMM, MME, <a href=\"https:\/\/www.darkreading.com\/attacks-breaches\/targeted-ransomware-attacks-show-no-signs-of-abating\" target=\"_blank\" rel=\"noopener\">GlobeImposter2.0<\/a>, which all actually belong to the Adhubllka ransomware family. All this confusion required further digging into the genealogy of the ransomware strain to identify it with proper attribution, Krishnan says.<\/p>\n<p>&#8220;This research also sheds light on the tracing of a family of ransomware to its origin using [threat actors&#8217;] communication channels and other means,&#8221; including contact emails, ransom notes, and execution method, which all played a vital role in analysis, he adds.<\/p>\n<h2 class=\"regular-text\">Racking Adhubllka<\/h2>\n<p>Adhubllka first <a href=\"https:\/\/twitter.com\/grujars\/status\/1220377483914235905\" target=\"_blank\" rel=\"noopener\">gained more attention<\/a> in January 2020, but had been &#8220;highly active&#8221; the previous year, the researchers noted. Threat group TA547 used Adhubllka variants in their campaigns targeting various sectors of Australia in 2020.<\/p>\n<p>A key reason it was so tricky for researchers to identify TZW as a spinoff of Adhubllka is because of the small ransom demands the group typically makes \u2014 $800 to $1,600. At that low level, <span>victims often pay attackers and <\/span>the attackers continue to fly under the radar.<\/p>\n<p>&#8220;This ransomware, like others, is being delivered via <a href=\"https:\/\/www.darkreading.com\/ics-ot\/critical-infrastructure-workers-spotting-phishes\" target=\"_blank\" rel=\"noopener\">phishing<\/a> campaigns, but the uniqueness lies as they only target individuals and small-sized companies, hence they won&#8217;t make a big news on the media channel,&#8221; Krishnan says. &#8220;However, this doesn&#8217;t mean [Adhubllka] won&#8217;t grow bigger in coming time, as they had already made necessary updates on their infrastructure.&#8221;<\/p>\n<p>In fact, in the future, the researchers anticipate that this ransomware may be rebranded with other names; other groups may also use it to launch their own ransomware campaigns.<\/p>\n<p>&#8220;However, as long as the threat actor does not change their mode of communication, we will be able to trace all such cases back to the Adhubllka family,&#8221; Krishnan says.<\/p>\n<h2 class=\"regular-text\">Keys to Identification<\/h2>\n<p>Indeed, the key that researchers used to tie the latest campaign to Adhubllka was to track previously linked Tor domains used by the actor, with the team uncovering clues from within the ransom note dropped to victims to trace it back to the source.<\/p>\n<p>In the note, the threat actor asks victims to communicate via a Tor-based victim portal to obtain decryption keys following ransom payment. The note indicated that the group changed its communication channel from v2 Tor Onion URLs to v3 Tor URL, &#8220;because the Tor community deprecated v2 Onion domains,&#8221; according to the post.<\/p>\n<p>Further, an additional sentence in the note \u2014 &#8220;the server with your decryptor is in a closed network Tor&#8221; \u2014 was only seen in two new Adhubllka variants: TZW and U2K, according to the researchers, which further narrowed down attribution.<\/p>\n<p>Other clues that pointed clearly to the latest variant of Adhubllka were the campaign&#8217;s use of the email address <a href=\"https:\/\/www.darkreading.com\/cdn-cgi\/l\/email-protection\" class=\"__cf_email__\" data-cfemail=\"94e4e6a4e0a7f1f5f9d4e4e6fbe0fbfaf9f5fdf8baf7fbf9\">[email&nbsp;protected]<\/a>, reported widely as belonging to the ransomware group, and its link to the MD5 variant sample of Adhubllka spotted in 2019.<\/p>\n<p>The research overall demonstrates how <a href=\"https:\/\/www.darkreading.com\/omdia\/ransomware-from-a-different-perspective\" target=\"_blank\" rel=\"noopener\">ransomware<\/a> is carefully crafted to throw threat hunters off the trail of cybercriminals, reinforcing the importance of defending against attacks by setting up an endpoint security solution, Krishnan says.<\/p>\n<p>&#8220;However, when a ransomware is newly formed\/coded, it can only be thwarted by basic security education, like not to click on malicious links delivered via email,&#8221; he says.<\/p>\n<p>Indeed, the most important protections for organizations lie in <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/microsoft-can-fix-ransomware-tomorrow\" target=\"_blank\" rel=\"noopener\">preventing ransomware<\/a> from entering an environment in the first place, &#8220;which means looking for behavior anomalies, privilege escalation, and the introduction of suspicious removable media into an environment,&#8221; Krishnan adds.<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>TZW is the latest version of Adhubllka, which has been active since 2019 but has gone largely unreported due to its lower ransom demands.Read More <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-53374","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ransomware With an Identity Crisis Targets Small Businesses, Individuals 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware With an Identity Crisis Targets Small Businesses, Individuals 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-08-24T18:39:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt706c564215e69a0c\/64e650eeb6ccf844b5e28aac\/Ransomware_Zoonar_GmbH_Alamy.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ransomware With an Identity Crisis Targets Small Businesses, Individuals\",\"datePublished\":\"2023-08-24T18:39:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/\"},\"wordCount\":739,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt706c564215e69a0c\\\/64e650eeb6ccf844b5e28aac\\\/Ransomware_Zoonar_GmbH_Alamy.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/\",\"name\":\"Ransomware With an Identity Crisis Targets Small Businesses, Individuals 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt706c564215e69a0c\\\/64e650eeb6ccf844b5e28aac\\\/Ransomware_Zoonar_GmbH_Alamy.jpg\",\"datePublished\":\"2023-08-24T18:39:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt706c564215e69a0c\\\/64e650eeb6ccf844b5e28aac\\\/Ransomware_Zoonar_GmbH_Alamy.jpg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt706c564215e69a0c\\\/64e650eeb6ccf844b5e28aac\\\/Ransomware_Zoonar_GmbH_Alamy.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware With an Identity Crisis Targets Small Businesses, Individuals\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware With an Identity Crisis Targets Small Businesses, Individuals 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware With an Identity Crisis Targets Small Businesses, Individuals 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-08-24T18:39:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt706c564215e69a0c\/64e650eeb6ccf844b5e28aac\/Ransomware_Zoonar_GmbH_Alamy.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ransomware With an Identity Crisis Targets Small Businesses, Individuals","datePublished":"2023-08-24T18:39:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/"},"wordCount":739,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt706c564215e69a0c\/64e650eeb6ccf844b5e28aac\/Ransomware_Zoonar_GmbH_Alamy.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/","url":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/","name":"Ransomware With an Identity Crisis Targets Small Businesses, Individuals 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt706c564215e69a0c\/64e650eeb6ccf844b5e28aac\/Ransomware_Zoonar_GmbH_Alamy.jpg","datePublished":"2023-08-24T18:39:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt706c564215e69a0c\/64e650eeb6ccf844b5e28aac\/Ransomware_Zoonar_GmbH_Alamy.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt706c564215e69a0c\/64e650eeb6ccf844b5e28aac\/Ransomware_Zoonar_GmbH_Alamy.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-with-an-identity-crisis-targets-small-businesses-individuals\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Ransomware With an Identity Crisis Targets Small Businesses, Individuals"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/53374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=53374"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/53374\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=53374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=53374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=53374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}