The Register: Security shop pwns ransomware gang, passes insider info to authorities

Mar 27, 2025

—

Source URL: https://www.theregister.com/2025/03/27/security_shop_pwns_ransomware_gang/
Source: The Register
Title: Security shop pwns ransomware gang, passes insider info to authorities

Feedly Summary: Researchers say ‘proactive’ approach is needed to combat global cybercrime
Here’s one you don’t see every day: A cybersecurity vendor is admitting to breaking into a notorious ransomware crew’s infrastructure and gathering data it relayed to national agencies to help victims.…

AI Summary and Description: Yes

Summary: The text discusses a cybersecurity vendor, Resecurity, to admits breaking into the infrastructure of the BlackLock ransomware gang and exploiting vulnerabilities to gather critical data. This operation highlights the ongoing challenges and strategies in the fight against ransomware, particularly concerning operational security (OPSEC) failures within criminal organizations, and the collaboration between private cybersecurity entities and government agencies.

Detailed Description:

The discussion revolves around Resecurity’s proactive approach to combating ransomware threats, primarily focusing on the BlackLock ransomware gang. The following points are significant:

– **Incident Overview**: Resecurity infiltrated the BlackLock ransomware gang, identifying and exploiting a Local File Include (LFI) vulnerability in their TOR-based data leak site.

– **Vulnerability Discovery**: The operation revealed that BlackLock had a misconfiguration that exposed clearnet IP addresses, allowing Resecurity to access server-side data, including critical configuration files and credentials.

– **Data Acquisition**: Key operational intelligence was gathered, including a history of commands and reused passwords by the operators, representing a significant vulnerability in BlackLock’s OPSEC.

– **Collaborative Efforts**: Resecurity successfully alerted various national cybersecurity agencies, including CERT-FR and the Canadian Centre for Cyber Security, about impending data leaks that involved victims in both France and Canada.

– **Gang Characteristics**:
– The BlackLock gang’s operations heavily relied on a clearnet file-sharing platform called Mega, which they used for data exfiltration and backups.
– Attribution efforts pointed to ties with Russian and Chinese cybercrime ecosystems based on linguistic analysis and operational patterns.

– **Connections Among Gangs**: Evidence suggests a connection between BlackLock, El Dorado, and Mamona ransomware groups, with significant overlap in victim lists and operational tactics.

– **DragonForce’s Involvement**: The text also explores the emergence of DragonForce, which allegedly defaced BlackLock’s infrastructure—a possible false flag operation indicating shifts within the ransomware community.

This report serves as a vital insight for security professionals regarding the evolving landscape of ransomware, showcasing the importance of threat intelligence, the need for robust security measures, and the benefits of collaboration between cybersecurity firms and governmental entities to mitigate risks associated with ransomware attacks.

2 2025 3 5 7 a access acquisition Act AI analysis and app Arch art as attack attacks attribution backup backups based by C Canada CERN challenges Chinese Chinese cyber CIA CleaR co Col collaboration collaborative collaborative efforts command community Configuration credential credentials crime critical cyber cyber security cybercrime cybercrime ecosystem cybersecurit Cybersecurity cybersecurity agencies cybersecurity firms D data data acquisition data exfiltration data leak data leaks day de e ecosystem ecosystems end EU exfiltration exp exploit face fail failures for France full g Gen GIS Go government government agencies Group gs H high Highlight HR http HTTPS in incident infrastructure Intel intelligence ite k Key l Labor land led Li local low man Misconfiguration N nation no o of on one operation operational security Operator OpSec organization organizations ory out over passwords patterns platform point pre proactive professionals Q R rag ransom ransomware ransomware attack ransomware attacks ransomware gang ransomware group ransomware groups ransomware threats rate RCE red report research researchers Resecurity reuse Risk risks Ro robust security Russia s search sec security Security Agencies security firm security measure security measures security professionals server SHA sharing shift side Sig SoC source SSE SSO system systems T tactics text the threat threat intel threat intelligence threats to Tor TP UI up ups US use uth V vendor victims vulnerabilities vulnerability vulnerability discovery Ware Wi x