{"id":6471,"date":"2021-09-07T15:41:42","date_gmt":"2021-09-07T13:41:42","guid":{"rendered":"https:\/\/www.retarus.com\/blog\/en\/what-ransomware-gangs-are-looking-for-in-an-ideal-victim"},"modified":"2024-05-07T11:26:24","modified_gmt":"2024-05-07T09:26:24","slug":"what-ransomware-gangs-are-looking-for-in-an-ideal-victim","status":"publish","type":"post","link":"https:\/\/www.retarus.com\/blog\/en\/what-ransomware-gangs-are-looking-for-in-an-ideal-victim\/","title":{"rendered":"What ransomware gangs are looking for in an ideal victim"},"content":{"rendered":"\n

Security experts recently investigated offers made by ransomware actors to buy network accesses on the darknet, shedding light on the criteria cyber criminals use when selecting target companies to blackmail with their maliciously encrypted data.<\/p>\n\n\n\n

Security intelligence company KELA examined<\/a> a total of 48 forum contributions from July 2021. The \u201cwant ads\u201d had been placed by various ransomware actors and were addressed to Initial Access Brokers (IAB), who provide initial network accesses. These IABs are actually hackers who focus all their efforts on penetrating company networks using methods such as brute force password attacks, exploits, and phishing. The access details are then sold to the highest bidding cybercriminals, who use it to smuggle malware onto the company network.<\/p>\n\n\n\n

Almost 40 percent of the darknet threads KELA investigated originated from actors identified as active participants in ransomware gangs. In one case<\/a>, the ransomware gang known as \u201cBlackMatter\u201d was especially looking for access to targets in the USA, Canada, Australia, and the UK with an annual turnover of at least US$100 million and 500 to 15,000 hosts. The ransomware gang was willing to pay between US$3,000 and US$100,000 for each network access.<\/p>\n\n\n\n