Inside the Shadows Tracking RaaS Groups, Cyber Threats

Inside the Shadows: Tracking Ransomware-as-a-Service Groups and Evolving Cyber Threats

This presentation by John Diljen, a Cyber Threat Intelligence (CTI) analyst at REAQuest, details research into tracking ransomware-as-a-service (RaaS) groups and evolving cyber threats. Ransomware exposure costs organizations in the United States an estimated $124 billion per year, highlighting the need to understand and proactively defend against these groups.

Data Collection Sources for RaaS Groups

Several data sources provide valuable intelligence on RaaS groups:

Dark Web Intelligence:

Data leak sites: Used by RaaS actors to publish compromised organization data and extort payments.

Forums: Platforms for recruitment of affiliates.

Attack Analysis: Both internal and external analyses provide telemetry on Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IoCs).

Internal Communication Leaks: Offer extensive knowledge about group operations.

Law Enforcement Notifications: Provide high-level TTPs and IoCs across multiple attacks.

Communication Leaks: Insights and Examples

Communication leaks, such as those from Conti, Black Basta, and LockBit, yield insights into:

Aliases used by group members.

TTPs employed by the group.

Connections to other threat groups.

Web activity (social media, GitHub, file sharing).

Forum communications.

Black Basta Case Study

Black Basta, observed since April 2022, is linked to the disbanded Conti ransomware group. Key characteristics include:

Affiliate Selection: Strict vetting process, prioritizing proven operators.

High Cost of Access: Access to their ransomware can cost over $1 million annually.

Notable TTPs:

Email Spam Bomb: Flooding a target's inbox to render it unusable, followed by Teams phishing to trick the user into executing malicious code or granting remote access.

Internal Leak (February 2025): A disgruntled member leaked internal chats due to the group's decision to target Russian banks, fearing law enforcement backlash.

Aliases: Notable aliases include 'Trump' (group leader, overseeing operations and payment decisions) and 'Tinkerer' (senior member managing call centers and phishing).

Organizational Structure: Mimics a cybersecurity organization with roles like intrusion specialists, managers, developers, and R&D for EDR evasion.

Collaboration: Evidence of communication with groups like QuackBot and Rostafari (DarkGate malware contributor). Tinkerer also worked as an affiliate for BlackSuit/Royal.

TTP Evolution:

Reconnaissance: Used ZoomInfo (revenue data), Shodan (exposed ports), and IntelligenceX (company/employee details).

Initial Access: Email spam bomb, brute-forcing, purchasing credentials from Initial Access Brokers.

Malware: ICE ID, Pikabot, QuackBot.

Exfiltration: RC Clone, WinSCP, FileZilla, Curl.

Dark Web Intelligence: Services and User Profiles

Monitoring the dark web reveals services and user profiles offering insights into RaaS operations:

Email Spam Bomb as a Service: Low-cost offerings (e.g., $9 per campaign, $500 lifetime) enable affiliates to send up to 100,000 emails daily.

Forum Activity:

Analysis of posts on XSS and Exploit forums revealed user profiles like 'Sebastian' and 'Marmallay Knight'.

These profiles, while not directly linked to Black Basta, provided breadcrumbs to identify potential Black Basta affiliates. Two such obfuscated profiles, 'IT workers' (seeking Microsoft accounts and RAT source code, conducting token capture) and 'code seller' (SEO poisoning, building encryptors), were identified.

Post-Leak Activity of Black Basta Members

Following the February 2025 leak, Black Basta's activity declined sharply, and their data leak site became unavailable. Potential destinations for members include:

BlackSuit/Royal Ransomware: Tinkerer, a former Black Basta negotiator, expressed dissatisfaction with the group, though BlackSuit's data leak site volume remains low.

Cactus Ransomware: A $500,000 payment referenced in Black Basta logs suggests collaboration or tool sharing. Cactus saw a sharp increase in named organizations around February 2025 but has since gone silent.

BlackLock/El Dorado: Rebranded to BlackLock, this group shows consistent data leak site volume, indicating no significant influx of affiliates.

LockBit and DragonForce

LockBit: Despite significant law enforcement action in February 2024, LockBit's data leak site volume showed no immediate decline, with a substantial spike in May. However, volume has fallen off since June, suggesting a lasting impact. Their teased LockBit 4.0 release in December 2024 did not restore previous market share.

DragonForce:

Cartel Model: Allows other RaaS groups to use DragonForce's infrastructure under their own branding.

Variants: LockBit 3.0 and Conti.

Aggressive Recruiting: Detailed forum posts offering complete workflow automation and specific software support.

Data Leak Site Defacements: Defaced sites of RansomHub and BlackLock to attract affiliates, leading to a spike in DragonForce's data leak site volume.

Investigation Telemetry and Proactive Defense

Analyzing incidents reveals the evolution of TTPs, particularly concerning email spam bombs and Teams phishing:

April 2024: Email spam bomb with Teams/VoIP phishing.

October 2024: Teams chats with QR codes and QR code-based phishing.

January 2025: Teams meetings granting host control, leveraging Microsoft.com domains for phishing legitimacy, DLL sideloading for lateral movement.

February 2025: QEMU hypervisor for persistence.

March 2025: Persistence via TTY hijacking, Telegram beaconing for C2.

April 2025: SSH tunneling.

These tactics continue to evolve even after groups like Black Basta disband, indicating affiliate movement.

Source of Fishing: Most common sources are on Microsoft.com domains, followed by compromised legitimate domains and then actual Microsoft.com domains (difficult to obtain but highly effective).

Common Elements: Usernames including 'help desk' or 'IT' in chat names, malicious files with names like 'filter' or 'anti-spam'.

Proactive Defense Strategies:

Microsoft Teams Monitoring: Create detections for chat creation events where the chat name includes 'help desk' or 'IT'.

Proxy/Windows Log Monitoring: Detect file downloads or executions with filenames containing 'filter' or 'anti-spam'.

Scattered Spider Case Study (Manufacturing Sector)

VIP Impersonation: Threat actors impersonated a CFO, leading to credential resets and MFA bypass by the help desk. Subsequent impersonation of a domain admin compromised identity management tenants (Okta, Azure AD).

Defense Recommendations:

Implement strict help desk verification procedures (both user-to-help desk and help desk-to-user).

Audit help desk verification processes, especially for third-party providers.

Educate users on Teams phishing and vishing, particularly the email spam bomb tactic.

Disable unauthorized remote monitoring and management tools.

Summary of Data Sources and Actionable Defense

Communication Dumps: Provide organizational structure, TTPs, group members, and collaborations.

Dark Web: Track forum activity, data leak site volume, and defacements.

Attack Analysis: Reveal TTP evolution, shared tactics, and enable detection/hunting searches.

These insights allow for the delivery of actionable defense recommendations.

John Diljen can be contacted on LinkedIn, and further threat research can be found on the Shadow Talk podcast.