Weaponized Lying: Unraveling RansomedVC’s Business Strategy

While ransomware groups rightly have a reputation for being morally and ethically bankrupt, many do play things straight with their victims. But RansomedVC is a notable exception. In some ways, it is “more dangerous” because of its expert ability to lie, according to researcher Jon DiMaggio.

See Also: Live Webinar | Securing the Cloud: Mitigating Vulnerabilities for Government

Unlike larger groups, such as LockBit or Clop, with RansomedVC, “you just don’t know what you’re getting, or what you’re dealing with, or whether you can trust them, because they lie often and they’re so good at it,” said DiMaggio, the chief security strategist at threat intelligence platform vendor Analyst1. “They are experts at using manipulation and media tactics to often claim that they’ve conducted attacks and have victim data they don’t actually have.”

As DiMaggio detailed in a new report, these lies have included regularly claiming to have crypto-locked victims’ data, which it doesn’t seem to have. In a case involving State Farm Insurance, RansomedVC claimed to have stolen customers’ personal identifiable information, which multiple media outlets duly reported, but that appeared to be pure fabrication. In another case involving Japanese communications firm NTT Docomo, the ransomware group appears to have created an entirely fictitious set of stolen data, which it used to try and extort the victim.

This type of behavior might seem radical or foolhardy if it traced to a ransomware newcomer, DiMaggio said. But based on his discussions with both the group and its affiliates, he said the leader of RansomedVC, who went by the name “RansomedSupport” and now appears to use the handle “RaznatovicAdmin,” appears to be a 40-something Bulgarian who previously worked with the Russian-speaking Ragnar Locker group, which was dismantled last October. Since then, the administrator appears to have rebooted RansomedVC – using the same infrastructure – as “Raznatovic,” in apparent reference to a deceased Serbian gangster and suspected war crimes suspect.

In this video interview with Information Security Media Group, DiMaggio also discussed:

• How the RansomedVC operation functions and the thinking behind its unorthodox approaches;




• What drives ransomware players to speak directly to security researchers;




• Takeaways for organizations hit by RansomedVC or its offspring.

DiMaggio has over 15 years of experience hunting, researching and documenting advanced cyberthreats. As a specialist in enterprise ransomware attacks and nation-state intrusions, he has exposed the criminal cartels behind major ransomware attacks, aided law enforcement agencies in federal indictments of nation-state attacks and shared his work at conferences such as RSA and Black Hat. In 2022, he authored “The Art of Cyberwarfare: An Investigator’s Guide to Espionage, Ransomware and Organized Cybercrime,” which received the SANS Difference Makers Award for cybersecurity book of the year.