The ALPHV ransomware gang, also referred to as BlackCat, is trying to put more pressure on its victims to pay ransom by providing an API for their leak website to increase the visibility of its attacks.
See also: Azimut: Italian Asset Manager victim of ransomware attack
This move follows the gang's recent breach of Estée Lauder, which resulted in the beauty company completely ignoring the attacker's attempt to engage in ransom negotiations.
API calls and Python crawler
Multiple researchers spotted earlier this week that data leak site ALPHV/BlackCat added a new page with instructions for using their API to collect timely updates about new victims.
APIs or Application Programming Interfaces are commonly used to enable communication between two software components based on agreed-upon definitions and protocols.
Malware research group VX-Underground spotted the new section on ALPHV’s website, but it appears the “feature” has been partially available for months, though not to the general public.
The ransomware gang published the API calls that would help extract various information about new victims added to their leak website or updates starting on a specific date.
The team also provided a crawler program written in Python to help retrieve the latest information on the data leak site.
Proposal: Clop ransomware group will earn $75-100 million through MOVEit attacks
Fewer victims paying
The gang's release of the API could be due to fewer victims succumbing to the ransomware's demands. The number of victims who paid fell to a record low of 34% in the second quarter.
Some actors continue to make a lot of money targeting the supply chain. Clop is estimated to have earned at least $75 million from the MOVEit data theft campaign.
Clop ’s breaches using a zero-day vulnerability in the secure file transfer platform MOVEit Transfer likely affect hundreds of companies, including Estée Lauder, which was also breached by ALPHV/BlackCat. Estée Lauder did not respond to any messages from ALPHV.
With fewer victims paying, ransomware gangs are looking for new methods to apply pressure and get the money.
Read also: Ransomware: Attacks increase by over 200%
source of information:bleepingcomputer.com
