datakeeper

Executive Summary

Datakeeper is a sophisticated ransomware-as-a-service (RaaS) operation that has been active since at least 2018. It offers a Windows-focused toolkit with hybrid encryption, utilizing an affiliate model known as 'Crystal Partnership RaaS' to distribute its operations. The group primarily seeks financial gain through ransoms and operates a split-payment mechanism to build trust within its affiliate network.

Goals & Targeting

Datakeeper's primary objectives are financial gain and organizational disruption. By leveraging affiliates under the 'Crystal Partnership RaaS' model, the group aims to maximize geographical reach and victim diversity. The targeting profile indicates a preference for organizations in industries where data loss would have significant consequences, such as healthcare and education, to ensure high ransoms.

Datakeeper is a notable ransomware-as-a-service (RaaS) operation that emerged in 2018 and has since expanded its influence by leveraging an innovative affiliate program, known as 'Crystal Partnership RaaS'. This group offers a ransomware toolkit for affiliates, utilizing hybrid RSA-4096 encryption to encrypt victim systems. The open registration on the dark web and split-payment mechanism have been key factors in Datakeeper's ability to attract and retain affiliates, fostering trust within its network. Despite its focus on financial gain, Datakeeper has demonstrated technical proficiency through its ransomware development and operational infrastructure. Its targeting patterns suggest a focus on sectors with high data value, such as healthcare and education.

Key Capabilities

• Windows-focused ransomware toolkit
• Hybrid RSA-4096 encryption
• Affiliate recruitment model ('Crystal Partnership RaaS')
• Split-payment mechanism for affiliates

Campaigns & Victims

Datakeeper has been involved in numerous ransomware campaigns targeting organizations globally, though specifics are limited due to the dark web's anonymity. Affiliates operate with relative autonomy, leading to varied tactics but consistently employing data encryption for financial gain. Past operations have focused on industries where data loss would impact business continuity and patient care, such as healthcare.

IOC Patterns

• Spear-phishing campaigns targeting Windows users
• Registration on dark web marketplaces
• Use of hybrid encryption for data extortion

Recommended Actions

• Implement employee training to recognize phishing attempts
• Enhance network monitoring for suspicious activities related to encryption payloads
• Conduct regular backups and ensure they are not accessible by malicious actors
• Segment networks to limit lateral movement in case of a breach

Suggested Tags