RansomedVC

RansomedVC, a new threat actor in the cybersecurity landscape, has emerged as a significant concern due to its unorthodox approaches and deceptive tactics. This group is suspected to be an enterprise of a single individual threat actor, who has previously been associated with other cybercrime operations such as Mogilevich and ExposedForum. In September, RansomedVC published data from nine victims on its leak site, including high-profile targets like Sony. The group was listed among the top three contributors to cyber attacks that month, alongside LostTrust and LockBit, according to a report by Malwarebytes. The operation behind RansomedVC is characterized by false claims and faux-extortion strategies. Notably, the group has claimed numerous victims, including State Farm Insurance, NTT Docomo, and Sony, often substantiating these claims with doctored or purchased data. For instance, in a case involving State Farm Insurance, RansomedVC falsely claimed to have stolen customers' personal identifiable information, leading to inaccurate media reports. These tactics have led to the group being permanently banned from certain forums for "scamming." The administrator behind RansomedVC, known as "Impotent" and now using the handle "RaznatovicAdmin," is believed to be a 40-something Bulgarian with ties to the Russian-speaking Ragnar Locker group, which was dismantled last October. Following the ban, the administrator rebooted RansomedVC under the name "Raznatovic," maintaining the same infrastructure. The group's unpredictable and deceitful practices make it a particularly challenging adversary in the cybersecurity landscape, as organizations cannot reliably predict or trust their actions.