In an attempt to put more pressure on their victims, some ransomware gangs have adopted the technique of cold-calling . Essentially, when hackers suspect that victims are trying to recover files from backups to avoid paying the ransom, they call them on the phone and put pressure on them. their
"We've seen this trend since at least August-September," Arete Incident Response's Director of IR & Cyber Threat Intelligence told ZDNet.
According to security firm Emsisoft , some of the ransomware gangs that have used the cold-calling technique include: Sekhmet and Maze (which have now ceased operations) as well as Conti and Ryuk .
“We believe it is the same call center team working for all ransomware gangs, as the templates and scripts are basically the same with some variations,” said Bill Siegel, CEO and co-founder of security firm Coveware.
Arete IR and Emsisoft said they have seen such phone calls to their customers.
According to a recorded call made on behalf of the ransomware gang, and shared with ZDNet, the callers had a strong accent, which means English was not their native language.
One of the security companies released an example of a cold calling, removing the victim's name:
“We know that an IT company is working on your network. We continue to monitor you and we know that you are installing SentinelOne antivirus software on all computers . But you should know that this will not help. If you want to stop wasting your time and recover data this week, we recommend that you discuss it with us in the chat, otherwise your network problems will never end“.
Ransomware gangs: They are constantly evolving their methods
The use of phone calls is a new tactic used by ransomware gangs to pressure victims into paying the required ransom.
Previous tactics included doubling the amount of money if victims did not pay within a specified time, threats to inform journalists about the company's breach, or threats to leak sensitive documents to so-called "leak sites."
The cold calling tactic to pressure victims has now emerged, but it is not the first time ransomware gangs have called victims (previous calls were about fraud).
In April 2017, the UK's Action Fraud group told schools and universities that ransomware gangs were calling their offices, pretending to be government officials and trying to trick employees into opening malicious files that led to ransomware attacks.
Source: ZDNet
