White Rabbit

White Rabbit is a notable threat actor in the cybersecurity landscape, known for its malicious activities and association with other prominent hacking groups. The group's name, derived from the character in Alice's Adventures in Quantum Wonderland, signifies its unique approach to cyber attacks. In January 2022, White Rabbit was linked to Syssphinx, another notorious hacking group, when it was discovered that they were using a variant of the Sardonic backdoor, a tool commonly associated with Syssphinx. Furthermore, the group has been observed using various ransomware families such as Ragnar Locker, White Rabbit, and BlackCat, with particular attention given to their use of the White Rabbit ransomware, which itself is based on Sardonic. The White Rabbit ransomware is reportedly used by "club members" of the RansomHouse platform, as per Emisoft’s threat analyst Brett Callow. This platform is known for hosting attacks carried out using their own tools, including the White Rabbit ransomware. In addition, White Rabbit has been connected to malicious URLs and is known to exploit AI tools like FraudGPT, WormGPT, DarkBARD, and others to write malicious code, generate phishing pages and messages, identify leaks and vulnerabilities, and create hacking tools. Furthermore, a significant link was identified between White Rabbit and two other ransomware groups, BianLian and Mario, by cybersecurity company Resecurity in December. This collaboration was particularly focused on targeting financial services organizations, highlighting a new level of threat posed by these groups. The security firm Bleeping Computer has suggested moderate confidence in linking these attacks to the financially driven FIN8 hacking group, also known as Syssphinx and White Rabbit. Over the past few years, this group has been observed using a number of ransomware threats, further emphasizing the pervasive and evolving nature of the White Rabbit threat actor.