Evil Corp, a malware group, has recently launched a new ransomware that asks its victims to pay a million-dollar ransom, as the group had previously gone quiet after the US Department of Justice charged some of its members in December 2019.
On June 23, it has been reported by the cybersecurity firm Fox-IT that a division of NCC Group, Evil Corp has been active since 2007, the group is considered to be one of the biggest cybercrime teams on the Internet.
However, they are known for using the Dridex malware and BitPaymet ransomware.
The study stated that Evil Corp has developed a new ransomware, called WastedLocker, which has been actively using to launch attacks since May 2020. There are reports that the group has asked for a combined total of $10 million from a number of US-based companies.
As per the report, the group had previously halted its operations until January 2020 due to the indictment of alleged members, Igor Olegovich Turashev and Maksim Viktorovich Yakubets.
NCC Group explained:
“Evil Corp are selective in terms of the infrastructure they target when deploying their ransomware. Typically, they hit file servers, database services, virtual machines and cloud environments. Of course, these choices will also be heavily influenced by what we may term their ‘business model’ – which also means they should be able to disable or disrupt backup applications and related infrastructure.”
Likewise, the research team said that it increased the time for recovery for the victim. In some cases, due to the unavailability of offline or offsite backups, it prevents the ability to recover at all.
NCC Group pointed out that the gang did not appear to threaten to publish victim’s information the way that the DoppelPaymer and many other targeted ransomware operations tend to do.
Thus, the team speculated:
“We assess that the probable reason for not leaking victim information is the unwanted attention this would draw from law enforcement and the public.”