A new addition has been made to the cyber-rogues’ gallery of ransomware gangs this week. Rhysida, a criminal group, has claimed responsibility for an attack on the British Library. The library has confirmed that personal data stolen in a cyber-attack last month has appeared for sale online.
Ransomware gangs use malicious software to infect an organization’s computers and render them inaccessible. They then demand payment, usually in cryptocurrency, to unlock the files. In recent years, these gangs have adopted a tactic known as “double extortion,” where they steal data and threaten to release it online to strengthen their negotiating position.
Rhysida emerged as the attacker this week by posting low-resolution images of the stolen personal information online. They are offering the data for sale on their leak site, starting with a bid of 20 bitcoin, equivalent to about £590,000.
Rafe Pilling, the director of threat research at cybersecurity firm Secureworks, described this as a classic example of a double extortion ransomware attack. The threat of leaking or selling stolen data is used as leverage to extort payment.
While Rhysida gained attention for targeting the British Library, they have also attacked government institutions in Portugal, Chile, and Kuwait. In August, they claimed responsibility for an attack on the US hospital group Prospect Medical Holdings.
US government agencies recently released an advisory note on Rhysida, stating that this emerging ransomware variant has been deployed against various sectors since May. The agencies also discovered that Rhysida operates a “ransomware as a service” (Raas) operation, renting out their malware to other criminals and sharing the ransom proceeds.
Rhysida is a new name to the public, but according to Secureworks, it originated from a criminal operation established in 2021 called Gold Victor. Criminal gangs often rebrand themselves when their existing name attracts too much attention from law enforcement.
The exact identity of the Rhysida gang is unknown, but it is assumed that they are Russian-speaking or from the Commonwealth of Independent States, which includes Russia, Belarus, and Kazakhstan.
The US agencies revealed that Rhysida attackers have used virtual private networks and phishing attacks to gain access to systems. Once inside, they typically remain undetected for less than 24 hours, compared to over four days in 2022.
Cryptocurrency, particularly bitcoin, is the preferred form of ransom demand for Rhysida attackers. It offers decentralization and transaction obscurity, making it difficult to track.
Paying ransom demands is heavily discouraged in the UK and the US. While not illegal, law enforcement does not endorse or encourage such payments. However, ransomware payments have been on the rise, with average payments nearly doubling to £1.2 million over the past year, according to cybersecurity firm Sophos.
As long as ransomware attacks continue to be lucrative, new “brands” will continue to emerge in the cyber-rogues’ gallery.