Table of Contents
The Announcement of Ransomware Group RansomedVC’s Shutdown
The ransomware and data extortion collective known as Ransomed[.]vc publicly declared through its Telegram channel that it would no longer continue with its operations. In what appears to be a legitimate cessation of activity, Ransomed[.]vc has expressed its intention to wind down its operations completely, indicative of a significant turning point in the group's history.
The Selling of RansomedVC’s Assets and Infrastructure
Along with halting its activities, Ransomed[.]vc has also signaled its intention to offload all aspects of its operation. It has put up for sale all its infrastructure, including databases, breached company access, and domain names. The group's ransomware forum, where it orchestrated its ransomware-as-a-service projects, remains operational, possibly to facilitate the sale of its assets and infrastructure. The intent behind purchasing them might be to create spin-off extortion operations, target specific victims, or further other malicious activities.
The Closure of RansomedVC’s Leak Websites
The shutting down process also saw the closure of one of Ransomed[.]vc's leak sites. The other leak site, although still operational, has a closing note prominently displayed on its homepage. This significant step further underscores the group's commitment to ending its operation and evidences the seriousness of its intentions. At the same time, the potential for the group's resources to be acquired by other threat actors could signal a concerning shift in the R&DE threat.
Main Operations and Targets of Ransomware Group RansomedVC
Brief History and Operations under Ransomware-as-a-Service (RaaS) Business Model
Ransomware group Ransomed[.]vc has been operating under the ransomware-as-a-service (RaaS) business model, which includes the provision of ransomware to other cybercriminals for a fee or a portion of the ransom. The group's operations were primarily coordinated on its ransomware forum. Aside from orchestrating attacks, the group also offered a ransomware builder and other infrastructure for sale, indicating a comprehensive approach towards cybercrime.
Focus on European Organizations
The group has particularly targeted European organizations, with nearly 60 percent of its victims identified by ZeroFox since August 2023 being Europe-based. This specific focus could be attributed to a variety of factors, including the potential for higher financial gains or strategic positioning in relation to European data breach laws.
Recent Attacks on Sony and the District of Columbia Board of Elections
In addition to its European targets, the group has been responsible for high-profile ransomware attacks, including one against Sony. The attack on Sony earlier this year illustrated the group's capability to infiltrate and exploit significant corporations. Despite the group's announcement to cease operations, the impact of its past activities remains significant, underlining the extent of the threat posed by ransomware groups such as Ransomed[.]vc.
Possible Reasons for the Shutdown
The Arrest of Six Individuals Associated with RansomedVC
One of the significant events that could have led to the shutdown of the group is the arrest of six individuals allegedly associated with Ransomed[.]vc. By getting tied up in legal processes, this development posed a major setback for the group. The arrests showed the increasing law enforcement attention to such cybercriminal activities, undoubtedly adding pressure to these operators and their illicit operations. This incident may have acted as a catalyst for Ransomed[.]vc's decision to close and sell off its operations.
Immediate Termination of all 98 Affiliates
Adding to the situation was the immediate termination of all 98 affiliates of Ransomed[.]vc. The affiliates played a crucial role in spreading ransomware and facilitating the group's operations. Their sudden termination would have considerably weakened the group's operational structure and capabilities. This, combined with the arrests, significantly disrupted Ransomed[.]vc's operations, likely leading to its decision to shut down.
Anticipated Impact on Ransomware Landscape
Minimal Effect due to Potential Migration of Affiliates to other RaaS Operations
Despite the closure of Ransomed[.]vc, it's unlikely that the overall ransomware landscape will experience a significant decrease in activity. The existing affiliates linked to the group could potentially migrate to other Ransomware-as-a-Service (RaaS) operations, perpetuating the cycle of ransomware attacks. Given their experience and the established RaaS business model, these affiliates could find it relatively easier to transition to other similar threat groups, thereby continuing their malicious activities.
Possibilities of Infrastructure Purchase for Further Malicious Activities
The sale of Ransomed[.]vc's infrastructure creates opportunities for other threat actors. These actors could acquire the technology to target new victims, create spin-off extortion operations, or conduct further malicious attacks. This means, rather than eliminating a threat, the group's closure might have inadvertently created a marketplace for other cybercriminals. Therefore, while Ransomed[.]vc might be exiting the scene, the ransomware threat landscape could become more dynamic as new groups take advantage of the group's infrastructure and resources.
