Ransomed ransomware group lists Ransomedvc Pentest Services! on its leak site

• Ransomware group: Ransomed
• Sector: Professional Services
• Announcement date: October 16, 2023

Ransomedvc announces new service offerings

The threat actor known as Ransomedvc has published a post on their leak site claiming to offer penetration testing services. This announcement, made on October 16, 2023, marks a shift in the group's public communication on their platform. Rather than a typical ransom demand or a notification of a successful breach, the post serves as a direct advertisement for professional services.

The group's post requests that target organizations be shared via their Telegram channel. This method of communication suggests an attempt to facilitate direct engagement with potential clients through third-party messaging platforms. Information regarding this group remains limited in the public domain, making it difficult to ascertain their full operational history or technical capabilities beyond this specific announcement.

Details of the announcement

The content of the post is highly specific in its intent. It does not contain any data leak or ransom demand; the content is solely an advertisement for the penetration testing services offered by the group. This is a notable departure from the standard behavior seen on many ransomware leak sites, which typically focus on extortion through the threat of data exposure.

In the context of ransomware leak sites, the standard model often involves double extortion, where attackers not only encrypt a victim's data but also threaten to release sensitive information on a public forum to pressure the organization into paying. While many groups use these sites to shame victims, Ransomedvc appears to be using the platform to solicit new business through a service-based model.

Data involved in the listing

The listing names no data types.

Analysis of the group's evolution

This announcement may indicate that the threat actor is attempting to expand their operations into a service-based model. Such a situation could suggest the emergence of new business models within the cybercrime ecosystem beyond Ransomware-as-a-Service (RaaS). While RaaS provides the infrastructure for others to conduct attacks, a service-based model focuses on providing specialized technical tasks, such as penetration testing, to clients.

The decision to issue such a notice may imply an effort to diversify their operational methods. By offering penetration testing, the group may be attempting to position themselves as a provider of offensive security capabilities, potentially targeting organizations that might otherwise be too secure for traditional ransomware attacks. This diversification could indicate a strategic move to find more reliable or consistent revenue streams within the illicit market.

Implications and organizational defense

The communication conducted via the mentioned Telegram channel may create a foundation for secondary risks and targeted attacks. When threat actors establish direct lines of communication with potential targets, it increases the surface area for social engineering and highly tailored exploitation attempts. Organizations must remain vigilant against unsolicited contact through various messaging platforms.

To defend against such evolving threats, organizations should implement robust security frameworks. This includes maintaining strict access controls, implementing multi-factor authentication, and conducting regular, legitimate penetration testing to identify vulnerabilities before malicious actors can exploit them. Monitoring for unauthorized communications and maintaining a strong incident response plan are also critical components of a modern defensive posture. As cybercrime models continue to diversify, the distinction between traditional ransomware and service-based malicious offerings may continue to blur, requiring a proactive and multifaceted approach to cybersecurity.