Researcher Saves Six Companies from Ransomware by Exploiting Security Flaws in Ransomware Gangs’ Infrastructure

A security researcher has revealed that six companies were saved from potentially paying significant ransom demands due to security flaws found in the web infrastructure of the ransomware gangs targeting them. In a rare win for the victim organizations, two companies received decryption keys that allowed them to restore their data without paying a ransom, while four hacked cryptocurrency companies were alerted before the ransomware gang could begin encrypting their files.  

Stykas, a security researcher and chief technology officer at Atropos.ai, conducted a research project aimed at identifying the command and control servers behind more than 100 ransomware and extortion-focused groups and their data leak sites. His goal was to find vulnerabilities that could expose information about these gangs, including details about their victims. Stykas disclosed his findings to TechCrunch ahead of his presentation at the Black Hat security conference in Las Vegas. He identified several rookie security flaws in the web dashboards used by at least three ransomware gangs, which were sufficient to compromise the inner workings of their operations. 

Ransomware gangs typically conceal their identities and activities on the dark web, an anonymous section of the internet accessible through the Tor browser. This anonymity makes it difficult to trace the real-world servers used for cyberattacks and the storage of stolen data. However, coding errors and security vulnerabilities in the leak sites used by these gangs to extort victims by

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.