FBI Shuts Down Dispossessor Ransomware Group’s Servers Across U.S., U.K., and Germany
Announced by the U.S. Federal Bureau of Investigation (FBI) on Monday, a disruption of online infrastructure associated with an emerging ransomware group known as Dispossessor (also referred to as Radar) took place.
The operation involved shutting down three servers in the U.S., as well as three servers in the United Kingdom, and 18 servers in Germany. Additionally, eight criminal domains in the U.S. and one in Germany were dismantled. Dispossessor is reportedly led by individual(s) identified by the online alias “Brain.”
In a statement, the FBI stated that Dispossessor, since its establishment in August 2023, has rapidly evolved into a globally impactful ransomware faction, focusing on assaulting small and medium-sized enterprises and institutions in various sectors such as production, development, education, healthcare, financial services, and transportation.
A total of 43 companies have been identified as victims of Dispossessor attacks, spanning countries like Argentina, Australia, Belgium, Brazil, Canada, Croatia, Germany, Honduras, India, Peru, Poland, the United Arab Emirates, the United Kingdom, and the United States.
Known for its close resemblance to LockBit, Dispossessor emerged as a ransomware-as-a-service (RaaS) entity following a dual-extortion model that has been popularized by other cybercrime syndicates. These attacks involve extracting victim data for ransom in addition to encrypting their systems. Those who refuse to comply are threatened with data exposure.
Threat actors have been observed using attack chains that exploit security vulnerabilities or weak passwords to infiltrate targets and acquire increased access to lock their data behind encryption barriers.
The FBI mentioned, “Upon attacking a company, if there was no communication with the criminal entity, the group would take the initiative to reach out to other individuals within the victim company, either through emails or phone calls.”
The FBI also added, “The emails contained links to video platforms showcasing the previously stolen files, always aimed at increasing the blackmail pressure and enhancing the willingness to pay.”
Previous reports from cybersecurity firm SentinelOne suggested that the Dispossessor group had been offering previously leaked data for download and sale, indicating that they were “reposting data associated with other operations like Cl0p, Hunters International, and 8Base.”
The increasing number of such takedown operations indicates a growing effort from law enforcement agencies worldwide to combat the persistent ransomware threat. Meanwhile, threat actors are constantly seeking innovative ways to thrive in the ever-changing landscape.
One trend involves an upswing in attacks executed through subcontractors and service providers, emphasizing how threat actors are exploiting trusted relationships to their advantage in carrying out large-scale attacks that often go unnoticed until data leaks or encrypted data are detected.
Data collected by Palo Alto Networks Unit 42 from leak sites shows that key industries affected by ransomware in the first half of 2024 were manufacturing (16.4%), healthcare (9.6%), and construction (9.4%).
The most targeted countries during that period included the U.S., Canada, the U.K., Germany, Italy, France, Spain, Brazil, Australia, and Belgium.
The company stated that ransomware activity was primarily fueled by newly disclosed vulnerabilities, with threat actors exploiting these opportunities swiftly to gain access to victim networks, elevate privileges, and maneuver across breached environments.
A noticeable development is the rise of new (or revamped) ransomware groups, accounting for 21 of the 68 distinct groups engaging in extortion attempts. There is also an increase in the targeting of smaller entities, as pointed out by Rapid7.
Rapid7 mentioned that this trend could be attributed to various factors, including the fact that smaller organizations possess valuable data sought by threat actors but often lack robust security measures.
Furthermore, another significant development is the professionalization of RaaS business models, with ransomware groups exhibiting greater sophistication and expanding their activities to resemble legitimate corporate entities.
Rapid7 highlighted, “These groups operate their marketplaces, sell proprietary products, and in some instances provide 24/7 support. They are also fostering a collaborative ecosystem and consolidating the types of ransomware they deploy.”
About Author
