iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
The Akira ransomware gang is enjoying an influx of “pen-testers”, according to a security researcher’s report.
Infamous ransomware-as-a-service operation LockBit may still be in operation, but it appears last month’s takedown of the gang by an international law enforcement action may have some impact after all.
According to a security researcher at threat intelligence firm RedSense, skilled hackers linked to the Zeon group are now moving away from affiliating with LockBit.
Unfortunately, it appears they’re moving to the Akira ransomware group.
“The LockBit takedown had a major impact on Zeon, which is now moving its pen-testers to work primarily for the Akira brand,” said Yelisey Bohuslavskiy, chief research officer at RedSense, in a LinkedIn post.
“This will result in an increase in attacks from this group. At the same time, it will also result in increased sophistication of locker deployment.”
The Zeon group is one of many to form after the Conti ransomware group disbanded following Russia’s invasion of Ukraine. Akira had close ties to Conti and still uses a locker based on Conti’s code, the Ryuk locker.
According to Bohuslavskiy, Zeon had been working with both Akira and LockBit, particularly the latter.
“In December, we obtained credible primary source intelligence directly related to post-Ryuk leadership, indicating that Zeon is operating as a group of elite pen-testers for both Akira and LockBit, with the latter being their main focus,” Bohuslavskiy said.
“Zeon provided pen-testers for big game hunting and their elite expertise in call-back phishing and call centre operations. In response, Akira and LockBit offered funds and their blogs/brands.”
Ransomware gangs often refer to themselves as pen-testers – a fig leaf to cover the fact they are just simply criminals.
Akira has been a frequent presence in Cyber Daily’s weekly ransomware report, making it into the top 10 most active ransomware groups for two out of the last three reports. With Bohuslavskiy’s report, we can now expect to see more of the gang – and the highly skilled Zeon group – in the future.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
