Ransomed ransomware group lists RANSOMEDVC is for sale on its leak site

• Ransomware group: Ransomed
• Announcement date: October 30, 2023

Ransomed group announces sale of RANSOMEDVC operation

The ransomware group known as Ransomed has announced that it is putting its entire ransomware operation up for sale. According to the announcement made on October 30, 2023, the group intends to sell its complete infrastructure and all exfiltrated data associated with the RANSOMEDVC operation.

This type of announcement, where a ransomware group attempts to liquidate its assets, is a significant development in the cybercrime ecosystem. Typically, ransomware groups operate through a model of double extortion, where they not only encrypt a victim's systems but also steal sensitive data to threaten the victim with public disclosure unless a ransom is paid. When a group decides to exit the business, they may attempt to monetize their existing assets, including the specialized tools used to conduct attacks and the data harvested from previous victims.

The group's claims regarding the sale and its motivation

RANSOMEDVC claims that the motivation behind this decision to terminate its operations is to avoid being monitored by federal agencies. The group has stated that the sale package is comprehensive and includes several critical components of their cybercriminal infrastructure. This includes a ransomware builder, various domain names, social media accounts, and Telegram channels used for communication.

Furthermore, the group claims that the sale includes 37 databases that allegedly belong to 11 different companies. The group also claims to be including access to a hosting panel as part of the transaction. Notably, the group asserts that their ransomware is highly capable, claiming it has the ability to bypass antivirus software and possesses the functionality to spread automatically to other devices within a network once an initial infection is established.

Data and assets involved in the listing

The sale listing identifies several categories of assets and data that are allegedly included in the package. Based on the group's claims, the items involved in this transaction include:

• Ransomware source code
• Corporate databases
• Social media accounts

The specific details regarding the volume of data, the exact size of the databases, or the specific ransom demands associated with the original attacks were not provided in the announcement. Information regarding the specific identities of the 11 companies mentioned in the claim was also not disclosed.

Analysis and potential implications for organizations

The announcement that RANSOMEDVC is for sale carries several significant implications for the cybersecurity landscape. If the ransomware ecosystem changes hands, it means that new, potentially different threat actors could gain access to these advanced tools. The claim that the ransomware builder can bypass antivirus software is particularly concerning, as it may increase the risk of successful phishing campaigns and network intrusions for various organizations.

The potential transfer of databases allegedly belonging to 11 different companies could trigger significant data breach risks. Such a transfer may lead to secondary extortion attempts, where the new owners of the data attempt to extort the affected organizations a second time. For the entities involved, such a breach could lead to the initiation of legal processes under data protection regulations, such as the General Data Protection Regulation (GDPR).

Organizations can defend against these evolving threats by maintaining robust security postures. This includes implementing multi-factor authentication, maintaining regular and offline backups, and ensuring that all software and antivirus definitions are up to date. Because the group's public profile and information are limited, organizations should remain vigilant against the potential emergence of new actors utilizing these specific tools.