redact

Executive Summary

RedACT is a medium‑sophistication criminal ransomware group that combines social engineering, compromised cloud resources and custom malware to execute financially motivated campaigns. Their operations leverage existing online personas and legitimate third‑party services for both phishing campaigns and covert command‑and‑control, resulting in exfiltration via cloud storage and occasional DDoS amplification through botnets.

Goals & Targeting

RedACT’s strategic objectives centre on maximizing financial return by compromising high‑value targets across diverse industries. The actor prioritises sectors that are budget‑tight yet potentially lucrative—such as healthcare, insurance, defense contractors, and critical utilities—and leverages insider or impersonated identities to lower detection risk. Attackers adopt a dual approach: initial spear‑phishing campaigns establish footholds, while subsequent lateral movement and persistence layers facilitate data exfiltration through cloud channels and ransomware deployment. By embedding malicious code in widely used cloud services, RedACT also seeks to extend its reach into third‑party ecosystems, broadening the attack surface for future operations.

Key Capabilities

• Local account discovery via net user commands
• Active reconnaissance scanning of victim IP blocks and services
• Compromise and use of existing online personas and accounts for trusted access
• Phishing campaigns leveraging compromised email, social media, and cloud accounts
• Use of cloud storage (Dropbox, OneDrive, AWS S3) for exfiltration and tool staging
• Build and operate botnets for DDoS/attack coordination
• Abuse legitimate third‑party web services and compromised accounts for C2 and phishing
• Leverage serverless cloud infrastructure (Cloudflare Workers, AWS Lambda) to obscure attribution
• Develop custom malware components: payloads, droppers, post‑compromise tools, backdoors, packers
• Implant malicious images in cloud or container registries for persistence
• Internal spearphishing leveraging stolen accounts and impersonation

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

RedACT has executed at least two documented ransomware operations, targeting Hologic and FCCI Insurance Group, both sectors with significant financial resources and valuable data. Campaigns appear to follow a rapid lifecycle: initial reconnaissance and credential compromise via phishing or compromised accounts, followed by lateral movement using automated scripts and local account exploitation, culminating in ransomware deployment and exfiltration through cloud storage. The actor’s use of serverless functions and malicious images suggests an emphasis on obfuscation and low‑trace persistence, while botnet activity indicates a capacity for distributed denial‑of‑service amplification to pressure victims or cover infrastructure. Though the data set is limited, observed patterns imply opportunistic targeting across multiple industries rather than selective, long‑term persistence in individual organizations.

IOC Patterns

• Compromise of existing online personas and accounts
• Use of compromised email accounts for phishing emails and domain acquisition
• Leverage cloud storage services to exfiltrate data and upload malware
• Compromised third‑party web service accounts used for command and control
• Embedding malicious code via cloud provider images or container registries
• Deployment of serverless functions (Cloudflare Workers, AWS Lambda) for covert C2

Recommended Actions

• Implement multi‑factor authentication for all email, social media, and third‑party service accounts.
• Monitor login activity across cloud services (OneDrive, Google Drive, AWS S3) for anomalous uploads or access patterns.
• Enforce least privilege on cloud resources and restrict access to serverless functions and container registries.
• Deploy endpoint detection and response tools that detect abnormal use of system utilities such as netsh, wmic, sc.exe, and net user, and identify botnet C2 traffic.
• Apply advanced email security (antispam, DMARC, BIMI) to reduce spear‑phishing successes.
• Audit and enforce stringent account privileges through group policy and lockout policies for local/domain users.
• Regularly review and revoke unused or suspicious API tokens and cloud credentials.
• Segment network zones and limit lateral movement capabilities.

Suggested Tags