In the ever-evolving sphere of cybercrime, a Russian-speaking faction known as WereWolves Ransomware has recently risen to infamy. They quickly made a name for themselves in the past year. Let’s delve into their methods of operation and their steadily increasing tally of victims, currently standing at 23.
What’s the story behind WereWolves Ransomware?
The WereWolves faction surfaced in May 2023, predominantly conversing in Russian, marking a novel class in the realm of cybercrime. Their interaction and tactical approach are indicative of their social and cultural roots, providing a peek into their strategies. Yet, there’s an air of mystery surrounding the group. The existence of a site under their control with a German moniker and their targeting similar victims as LockBit leave a couple of unresolved queries for the time being.
Operating Style
The WereWolves ransomware collective utilizes a variety of digital assault strategies, with a particular emphasis on a version of the LockBit3 ransomware. Their modus operandi is defined by a two-pronged extortion scheme where they not only scramble the victim’s data but also hold it hostage under the threat of public exposure unless a payoff is made. An earlier version of LockBit found its way into the public domain and was promptly adopted by various threat actors, each putting their own spin on it. However, with WereWolves the circumstances appear to be distinct, as they could potentially be a LockBit partner.
Intended Audience
The WereWolves cyber-extortion syndicate employs a broad-based approach, affecting numerous sectors and companies around the world. The number of entities that have fallen prey to their attacks stood at 23 as of January 9, 2024, primarily encompassing small to medium-sized businesses and groups, suggesting a penchant for less challenging targets. Yet, they don’t seem to be zeroing in on any particular nation at present, hinting at a probable monetary-driven agenda.
Hiring Tactics
The tactics used by the WereWolves group to attract new members are just as fascinating as their cyber operations. Rather than sticking to the clandestine methods often used by many cybercrime factions, the WereWolves have adopted a more transparent and light-hearted strategy for team growth.
Digital Existence and Interaction
The WereWolves hacking group sets itself apart with a captivating digital persona. Their operational site is more than a mere communication platform; it functions as a central hub for promoting their narrative, spreading information, and attracting new members. They skillfully use their online footprint to advance their objectives, engage with their targets, and sustain their illicit digital network. This dimension of their work showcases how contemporary cybercrime units adapt to and exploit the virtual environment for their malevolent pursuits.
In their “Mission” section, they claim to offer a pentest service, a typical punchline used by ransomware groups that lacks originality.
Associations and Analogies
HackManac’s blog post throws up some fascinating points, notably that the WereWolves group appears to be targeting the same six victims as the LockBit group had done earlier. The victims, which include a range of organizations such as the Agency for Electronic Communications and La Poste Mobile, seem to be identical. The evidence lies in the uncanny resemblance of the posts about these victims – from matching samples to the exact amount of data allegedly stolen. This coincidence prompts us to ponder if there is any overlap or possible links between these two digital lawbreaking entities.
Victims of WereWolves Ransomware
Hailing from a Russian-speaking background, the WereWolves ransomware gang has set its sights on a variety of domains, from Finance to Manufacturing. Their strategy might appear haphazard, but they tend to concentrate on sectors that are vulnerable yet influential, such as small to medium-sized services and institutions. This suggests that their activities may not be solely driven by financial gain, but could also be intended to cause widespread disruption.
The team’s choice of victims emphasizes their aim to inflict substantial operational and financial harm to enforce ransomware, affecting industries that are vital to the operation of diverse economies and communities.
Interestingly, in contrast to conventional Russian ransomware collectives, their target lists incorporate both Russia and former Soviet nations, as well as countries in close proximity to the Soviets.
On the breach disclosure platform, the 4th out of the 5 affected parties possesses a .ru domain
Final Thoughts
The WereWolves team indeed possesses a unique strategy, however, skepticism surrounds their assault tactics. As aptly pointed out by HackManac, it’s vital to confirm or debunk the cyber onslaughts carried out by WereWolves. This is a critical step in truly assessing the danger posed by this ransomware group, particularly as they’ve managed to function largely undetected. The simultaneous execution of six attacks along with the actions of LockBit raises suspicions about potential collaboration between these two cybercrime factions. Therefore, continuous observation and scrutiny are imperative to fully comprehend the workings and objectives of the WereWolves team.
The fact that even a minor event could escalate into additional cyber assaults highlights the importance of this one-year-old team using a perilous LockBit Black variant. This emphasizes the necessity for alert, flexible cyber defense strategies to counter such risks.
