RansomVC

Executive Summary

RansomVC has emerged as a new extortion-focused threat actor leveraging GDPR penalties for financial gain. Their operations are characterized by sophisticated public relations campaigns and targeted threats against organizations holding sensitive data.

Goals & Targeting

RansomVC's strategic objective is financial gain through extortion, targeting sectors such as healthcare, finance, and retail where sensitive data exposure can result in significant penalties. Their global reach is evident in their use of diverse communication channels, suggesting a broad targeting strategy across various countries to maximize potential victims.

RansomVC operates with a focus on exploiting the fear of GDPR-related fines to coerce payment from victims. They utilize multiple communication channels, including Telegram and Twitter/X, to promote their extortion schemes. The group primarily targets organizations that may have exposed personal data, potentially leading to legal consequences under GDPR.

Key Capabilities

• Spear-phishing campaigns
• Data exfiltration techniques
• Encrypted communications for extortion ransoms

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

RansomVC has initiated several campaigns targeting organizations with exposed data. Their modus operandi involves identifying sensitive information, threatening exposure unless a ransom is paid, and employing encrypted communication channels to maintain anonymity.

IOC Patterns

• Spear-phishing emails containing links to their clearnet site
• Encrypted communications over the dark web

Recommended Actions

• Implement advanced email filtering solutions for phishing detection
• Enforce strong encryption protocols on data at rest and in transit
• Monitor public domains and forums for mentions of GDPR-related extortion attempts

Suggested Tags