Summary: Ransomware actors are innovating by incorporating advertisements in their ransom notes to solicit insider information. Notable groups like Sarcoma and a LockBit impersonator, DoNex, are leveraging this new tactic, aiming to recruit individuals for information in exchange for financial incentives. These developments come amidst a rise in ransomware activities and profits despite increasing law enforcement efforts against cybercrime.
Affected: Various organizations targeted by ransomware groups
Keypoints :
- Ransomware notes now include pseudo advertisements soliciting insider information.
- Groups like Sarcoma and DoNex are leading this trend, promising rewards for information about targeted companies.
- The communication is conducted through Tox messenger to ensure privacy for those responding to the ads.
Source: https://www.darkreading.com/threat-intelligence/cybercriminals-traitorous-insiders-ransom-notes