Shadowsyndicate

ShadowSyndicate, a threat actor that emerged in 2019, has been implicated in multiple ransomware operations according to cybersecurity firm Group-IB. The group is known for its affiliations with various ransomware groups and programs, and has been involved in several ransomware projects such as JSWORM, Nefilim, Karma, and Nemty. In addition to developing ransomware and managing Ransomware-as-a-Service (RaaS) programs, ShadowSyndicate has launched its own RaaS program based on the Nokoyawa ransomware. Over the past year, ShadowSyndicate has reportedly deployed seven different ransomware families in attacks. The group's infrastructure has been linked, albeit with a low degree of confidence, to TrickBot, Ryuk, FIN7, and TrueBot malware operations. In September, Group-IB also linked ShadowSyndicate's infrastructure to attacks from Quantum ransomware, Nokoyawa, and the Alphv ransomware hackers. Furthermore, one of the IP addresses used by the hackers to scan for vulnerable servers has been associated with ShadowSyndicate. Since February 29th, threat actors including ShadowSyndicate have been scanning the internet for vulnerable servers, exploiting flaws in Python libraries among other vulnerabilities. This is part of the group's strategy to find susceptible versions of utilities as an entry point for network compromise. The group's activities were discussed in depth during a podcast episode on Security Weekly News on September 26, 2023, which included a discussion about the events leading to a prosecution case against the group.