North Korean hackers linked to Play ransomware attacks
Jumpy Pisces is moving away from espionage and into ransomware attacks
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Jumpy Pisces, a North Korean state-sponsored threat actor also known as Onyx Sleet, or Andariel, has recently shifted its focus toransomwareattacks, experts have warned.
In a recent technical analysis, researchers from Unit 42 said although Jumpy Pisces had previously focused on cyber-espionage and financial crimes, it has in recent times teamed up with the infamous Play Ransomware group (also known as Fiddling Scorpius).
Play emerged in the summer of 2022, and has since then grown into a formidable threat actor - so much so that in December 2023, theFBI warnedabout this group, claiming it compromised roughly 300 victims in its first year and a half of its existence.
Initial access brokers
“Since June 2022, the Play (also known as Playcrypt) ransomware group has impacted a wide range of businesses and critical infrastructure in North America, South America, and Europe,” the agency said at the time. “As of October 2023, the FBI was aware of approximately 300 affected entities allegedly exploited by the ransomware actors.”
The role Jumpy Pisces plays in this partnership is not definitively determined, but it’s most likely that it acts as an initial access broker (IAB), opening Play operators doors to different victims.
Unit 42 believes this change is significant because it shows that Jumpy Pisces is getting more involved in ransomware activities, and are using existing ransomware infrastructure instead of building its own. That makes the attacks more sophisticated, and possibly - more widespread.
However,BleepingComputeradded that in an average ransomware attack, there are multiple parties involved. Most ransomware variants these days operate on an “as-a-service” model, meaning that the developers are not the ones infecting victims, and that the two end up splitting eventual profits. Add IAB to the mix, and now there are at least three separate threat actors engaged in a single attack.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
In any case, companies should be extra vigilant, the researchers conclude, warning that this new teamup might lead to serious ransomware infections.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Scammers are using fake copyright infringement claims to hack businesses
HPE reveals critical security bug affecting networking access points
From Dishonored to Mafia: Definitive Edition, some of my favorite games are free right now for Amazon Prime members
