Supply Chain Hits, Credential Harvesting

Ransomware groups continue to display more innovation, persistence and planning in their quest to amass fresh ransom-paying victims and maximize profits. This has included repeat supply chain attacks, harvesting credentials to use in later campaigns, as well as launching new affiliate programs.

See Also: Top 10 Technical Predictions for 2025

Attack volume remains high. The quantity of victims listed across ransomware groups’ data leak sites increased by one-third from September to October, says a report from cybersecurity firm Cyble. Groups listing the most victims included high-fliers Qilin and Akira, newcomer Sinobi – which only appeared in July – and stalwarts INC Ransom and Play.

Blockchain intelligence firm Chainalysis tracked $1.25 billion in ransom payments in 2023, dropping to $814 million in 2024.

Innovation remains rife as groups seem set on reversing that decline.

Supply Chain Attacks

To do so, some groups seek scale. This includes the Clop group, aka Cl0p, which has repeatedly exploited zero-day vulnerabilities in widely used software to execute supply chain attacks that steal data from many organizations at once and hold it to ransom.

After a run of attacks targeting zero-day flaws in managed file transfer software, the group used the same strategy against Oracle E-Business Suite versions 12.2.3 through 12.2.14 to steal data.

Clop appears to have targeted two zero-day vulnerabilities, “both of which allow unauthenticated access to core EBS components,” giving the group “a fast and reliable entry point, which explains the scale of the campaign,” said cybersecurity firm SOCRadar. Oracle issued updates fixing both of those flaws.

Data theft tied to that campaign appeared to begin by August, although it didn’t come to light until Clop revealed it on Sept. 29 (see: Clop Attacks Against Oracle E-Business Suite Trace to July).

Many EBS-using organizations appeared to remain exposed through October, and attacks intensified following the release of proof-of-concept attack code, SOCRadar said.

Last week, Clop began listing alleged EBS-using victims on its data leak site who hadn’t paid a ransom, naming Broadcom, Canon, Oracle, Mazda, Michelin and the Estée Lauder Companies, among others.

Only non-paying victims typically feature on such listings, meaning they don’t provide a complete picture. Reports suggest that about one-quarter of all victims now pay a ransom, although oftentimes having negotiated down an attacker’s initial demand.

Harvesting Credentials

Rather than immediately stealing data, some groups instead exploit vulnerabilities en masse to harvest credentials from edge devices, then use them later as part of cryptolocking malware campaigns.

This tactic seems to be getting employed by the Akira – as well as Fog – ransomware groups in their targeting of SonicWall SSL VPN firewalls.

Security experts said the attackers appear to have previously harvested credentials by exploiting CVE-2024-40766, an improper access control vulnerability in SonicWall SonicOS that the vendor patched in August 2024.

In September, SonicWall reiterated a previous warning that patching alone is not sufficient, and that organizations must also rotate credentials after updating to block attackers from reusing harvested credentials (see: Akira’s SonicWall Hacks Are Taking Down Large Enterprises).

New Affiliate Operations

One of the big reasons for ransomware’s success has been cryptocurrency, which makes it easier for groups to monetize and cash out their attacks. Another has been the rise of the ransomware-as-a-service business model. This allows for specialization: operators can develop malware and shake down victims, while affiliated business partners focus on hacking, rather than malware development, with both reaping the rewards.

Every time a victim pays a ransom, the industry standard is for an affiliate to keep 70% to 80%.

For the extremely active, largely teenage cybercrime collective lately calling itself Scattered Lapsus$ Hunters, one innovation has been to launch its own affiliate program, using a new ransomware variant, dubbed ShinySp1d3r. In August, Scattered Lapsus$ Hunters or SLSH announced the forthcoming launch of its own RaaS program, and on Nov. 19, security researchers recovered apparent samples of the cryptolocking malware already being used or at least tested in the wild.

Previously, members of the constituent groups – Scattered Spider, Lapsus$ and ShinyHunters – have been tied to the use of such strains as ALPHV, aka BlackCat, as well as Qilin, DragonForce and RansomHub, obtained through affiliate programs.

Launching ShinySp1d3r is “likely in an effort to increase profits by eliminating the sharing of ransoms with platform providers,” said cybersecurity firm ZeroFox. At the same time, the group could also increase profits by recruiting its own affiliates.

As designed, its ransomware includes some never-before-seen capabilities, including “the ability to propagate to other devices in a network, create its own service to run malware, then initiate the malware, and finally generate a startup script – all contained within the encryptor itself,” ZeroFox said.

Whether the malware works well remains to be seen. The member of Scattered Lapsus$ Hunters responsible for managing the ShinySp1d3r ransomware, “Rey,” previously participated in the Hellcat ransomware operation as well as on BreachForums, first using the “Hikki-Chan” moniker, threat intelligence firm Kela reported in March. Kela unmasked Rey’s actual identity – Jordanian national named Saif Khader – and shared that information with law enforcement, although didn’t release it publicly until Wednesday, after cybersecurity journalist Brian Krebs publicly reported the 15-year-old’s name.

Of note, ShinySp1d3r is just a version of Hellcat ransomware that’s been updated using artificial intelligence tools, Khader told Krebs. “I gave the source code of Hellcat ransomware out basically,” he said.

When Innovation Fails

Whether this supposedly AI-enhanced version of Hellcat works as intended remains to be seen. One repeat problem faced by ransomware groups is having sloppily coded cryptolocking malware that doesn’t properly encrypt a victim’s data before deleting it, meaning what’s left has been permanently corrupted and can’t be recovered, even with a decryptor.

This is the case with a recently discovered ransomware variant called Obscura.

Due to Obscura’s poor coding, “it fails to write the encrypted temporary key to the file’s footer,” which becomes a problem because “for files over 1 gigabyte, that footer is never created at all – which means the key needed for decryption is lost,” reported ransomware incident response firm Coveware.

This fact might not come to light until after a victim has paid a ransom, especially if it’s done a “proof of life” test in which the victim sends an encrypted file to the attacker for decryption, to prove it’s possible. “The problem is that these samples almost never include large files, and large files are the most likely to be damaged by flaws in the ransomware code,” Coveware said.