North Korean hackers linked to Play ransomware attacks

North Korean state-sponsored threat actor Jumpy Pisces, also known as Onyx Sleet or Andariel, has recently shifted its focus to: ransomware Experts warned of attacks.

In a recent technical analysis, researchers from Unit 42 said that although Jumpy Pisces had previously focused on cyber espionage and financial crime, it had recently teamed up with the notorious Play Ransomware group (also known as Fiddling Scorpius).

Play emerged in the summer of 2022 and has since evolved into a formidable threat actor; so that in December 2023, FBI warned He claimed about this group that it had endangered nearly 300 victims in its first year and a half of existence.

Initial access agents

“Since June 2022, the Play (also known as Playcrypt) ransomware cluster has impacted a wide range of businesses and critical infrastructure in North America, South America and Europe,” the agency said. “As of October 2023, the FBI was aware of approximately 300 affected organizations that were allegedly exploited by ransomware actors.”

The exact role that Jumpy Pisces plays in this partnership has not been determined, but it is most likely acting as an initial access broker (IAB), opening the doors of Play operators to different victims.

Unit 42 believes this change is significant because it shows that Jumpy Pisces is becoming more involved in ransomware activities and is using existing ransomware infrastructure rather than creating its own. This makes attacks more sophisticated and possibly more widespread.

But, BleepingComputer He added that the average ransomware attack involves multiple parties. Most ransomware strains today operate on an “as-a-service” model; This means that the developers do not infect the victims and the two end up splitting the final profits. Add IAB to the mixture; There are now at least three separate threat actors in a single attack.

The researchers concluded that companies should be extra careful in any case, warning that this new team could lead to serious ransomware infections.

Related Posts