@BushidoToken Threat Intel

  Introduction This blog is part of a cyber threat intelligence (CTI) blog series called Tracking Adversaries that investigates prominent or new threat groups. The focus of this blog is EvilCorp, a sanctioned Russia-based cybercriminal enterprise known for launching ransomware attacks, and RansomHub, a prominent ransomware as a service (RaaS) operation run by Russian-speaking cybercriminals. These two threat groups have been linked together through cooperation on intrusions and IOCs and TTPs shared by multiple CTI sources. The implication of this link is critical due to RansomHub being the most active ransomware gang and is working with a well-known sanctioned affiliate. Who is RansomHub? Active since February 2024, RansomHub is a RaaS operation formerly known as Cyclops and Knight and is run by Russian-speaking adversaries. It  is currently used by more and more cybercriminals that are ex-affiliates of other RaaS operations. This includes the ALPHV/BlackCat RaaS an...

  A new web skimmer, dubbed Meyhod, has been disclosed by RiskIQ. The malware (named after a typo in the code) appeared in October on several e-commerce sites, including the hair treatment company Bosley and the Chicago Architecture Center (CAC). While investigating the attacker's domain (jquerycloud[.]com) a bit further and other potential victims from this campaign were uncovered some months ago. This includes Doves Farm UK, The Fruit Company, Customer Earth Promos, and - due to the file names - potentially iCanvas or TFC: Active compromise of dovesfarm.co.uk: Skimmer 1: Identifier - sClass="yeikyd" - 'dovesfarm.js' (available here ) Skimmer 2: Identifier - sClass="frydbt" - 'icanvas.js' (available here ) Skimmer 3: Identifier - sClass="bfiyad" - 'tfc.js' (available here ) Skimmer 1 - Listener: Skimmer 2 and 3 - Listener: Skimmed Data: RC4 encryption: Data collected: Credit Card Number, Card Holder Name, CVV, expiry day, mont...