robinhood

Executive Summary

The Robinhood threat actor, first observed in April-May 2019, is a ransomware group known for targeting municipal and government entities. Their high-profile attacks include the disruption of city services in Baltimore, Maryland, where they demanded 13 BTC. The group operates as a limited closed-circle model rather than through affiliates, focusing on high-value targets to maximize financial gain.

Goals & Targeting

Robinhood's primary objectives are financial gain through ransom payments and organizational disruption. They target sectors with high reliance on IT infrastructure, such as municipal governments and public services. Their focus on these sectors is driven by the potential for larger ransom demands and the critical nature of the services they disrupt. The group's victims typically include city governments, law enforcement agencies, healthcare providers, and other essential service providers.

Robinhood is a sophisticated ransomware group that emerged in 2019 and has demonstrated both technical expertise and strategic patience. Their attacks typically involve the encryption of critical systems, leading to significant disruption of municipal services. Unlike many other ransomware groups, Robinhood operates as a tightly-knit, closed-circle entity rather than leveraging an affiliate network, which suggests a more controlling approach to their operations and revenue generation. The group's focus on municipalities and government entities indicates a strategic targeting model aimed at maximizing the impact of their attacks while ensuring high-ransom potential. Their operational timeline extends from 2019 to present activity, underscoring their persistence and adaptability in the cybercrime landscape.

Key Capabilities

• Ransomware distribution
• Phishing campaigns with malicious macros
• Data encryption for extortion
• Long-term operational persistence
• Targeting high-value victims

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Robinhood has demonstrated a patient and methodical approach to campaign operations. Their attacks often involve prolonged system encryption and data exfiltration, followed by the issuance of extortion demands. Notable campaigns include the Baltimore attack in 2019, which caused significant disruption to city services. The group appears to target North American municipalities primarily but has shown flexibility in operational geography as their techniques evolve. Recent activity indicates a focus on smaller cities with weaker cybersecurity defenses, though major urban targets remain within their threat calculus.

IOC Patterns

• Ransomware payloads delivered via phishing emails
• Use of malicious macros in Office documents
• Known Cobalt Strike and Mimikatz indicators
• Leverage of legitimate tools for TTP obfuscation

Recommended Actions

• Enhance employee security awareness training to detect phishing attempts
• Implement network segmentation to limit ransomware spread
• Monitor for suspicious activity using endpoint detection and response (EDR) tools
• Regularly backup critical systems in isolated environments
• Update and patch software to mitigate known vulnerabilities

Suggested Tags