The Ransomware-as-a-Service (RaaS) market is a fast-moving one. Prominent RaaS or affiliate groups can form, wreak havoc, and disband all within a short period of time. In this blog, Group-IB researchers will detail what they believe to be a new RaaS group that appears to operate differently from the rest: Enter ShadowSyndicate.
What is unusual about ShadowSyndicate (not to be confused with Shadow ransomware)? Well, it’s incredibly rare for one Secure Shell (SSH) fingerprint to have such a complex web of connections with a large number of malicious servers. In total, Group-IB found ShadowSyndicate’s SSH fingerprint on 85 servers since July 2022. Additionally, the researchers can say with various degrees of confidence that the group has used seven different ransomware families over the course of the past year, making ShadowSyndicate notable for their versatility.
Read more…
Source: Group-IB