meow

Executive Summary

Meow is a medium-sophistication criminal threat actor that has evolved from offering Ransomware as a Service (RaaS) using the Conti v2 codebase to focusing on data extortion, targeting primarily US healthcare and medical research organizations. Their operational period spans from 2022 with recent aggressive activity in 2024, shifting strategies to avoid file encryption and instead monetize stolen data.

Goals & Targeting

Meow targets US healthcare and medical research organizations due to their access to sensitive and valuable data. Healthcare sector victimology aligns with the goal of extracting high-value information for sale on dark web markets, leveraging the sector's often limited cybersecurity defenses and reliance on sensitive data systems.

Meow emerged in 2022, initially operating as a Ransomware as a Service (RaaS) group using the Conti v2 codebase. They shifted theirmodus operandito focus solely on data extortion, selling stolen data without encrypting files, targeting sensitive sectors like US healthcare and medical research organizations. This strategic change likely reflects an adaptation to avoid detection or mitigate risks associated with ransomware operations. Their primary motivation is financial gain, achieved through the monetization of stolen data.

Key Capabilities

• Data extortion capabilities
• Ransomware development and distribution
• Stolen data monetization expertise
• Targeted attacks on healthcare organizations

MITRE ATT&CK Tactics

Software / Tooling

Campaigns & Victims

Meow has conducted numerous campaigns targeting healthcare and medical research organizations. Their campaign patterns include data theft with a focus on financial gain through selling stolen information. Notable operations include significant breaches in the US healthcare sector, demonstrating their ability to persistently target this vertical.

IOC Patterns

• Data exfiltration activities
• Lateral movement within networks
• Phishing emails targeting healthcare workers

Recommended Actions

• Enhance email filtering to detect and block phishing attempts.
• Monitor network traffic for signs of data exfiltration.
• Implement strict access controls on sensitive data repositories.
• Conduct regular cybersecurity awareness training, particularly for healthcare staff.

Suggested Tags