A group of hacktivists associated with the Ukrainian Cyber Alliancehacked the servers of the Trigona ransomware gang and deleted all data , after first keeping copies.
Ukrainian Cyber Alliance hackers say they stole all data from the gang's systems, including source code and databases ,which may include decryption keys.
Ukrainian hackers gained access to the Trigona ransomware infrastructure using a public exploit for the CVE-2023-22515. This is a critical vulnerability in the Confluence Data Center and Server.
See also: Chilean Government: Warns of Black Basta ransomware attacks
The Ukrainian Cyber Alliance first compromised the Trigona ransomware's Confluence server about six days ago. It then managed to map the group's infrastructure without being detected.
According to BleepingComputer, a hacktivist, going by the alias herm1t , published screenshots of the ransomware gang 's internal support documents , which appears to have caused panic among cybercriminals. Their first reaction was to change the password and take the public-facing infrastructure offline.
However, a few days later, Ukrainian activists managed to steal all the information from the administration and victim panels, their blog, the leak , and internal tools.
herm1t told BleepingComputer that they stole data from the developer environment and from cryptocurrency hot wallets.
See also: NoEscape ransomware: Targets healthcare organizations
The hacktivists don't know if the information they have contains decryption keys. If they find something, they will release it publicly.
After stealing all the data of the Trigona ransomware gang, hackers from the Ukrainian Cyber Alliance deleted and defaced the criminals' websites, also sharing the key to the admin panel website.
Ukrainian Cyber Alliance
Starting in 2014, many hacktivists in Ukraine and around the world began to collaborate to defend the country, in terms of cybersecurity, and counter Russian attacks.
About two years later, individual hackers and groups joined together to form the Ukrainian Cyber Alliance, now registered as a non-governmental organization, and began targeting various organizations and individuals supporting attacks on Ukraine.
According to the organization's Wikipedia page, there have been several successful hacking operations that resulted in the disclosure of information about Russian activity. The hacktivists also claim to have broken into the Russian Ministry of Defense twice in 2016. Another success was the hack of the emails of Vladislav Surkov, an individual believed to be associated with Russian propaganda.
See also: Kansas courts likely hit by ransomware attack
Trigona ransomware
Trigona ransomware emerged in late October 2022, when the gang opened a Tor website to negotiate ransom with its victims.
Earlier samples of the malware had appeared, but they did not have a specific name. Before the Trigona brand, operators used emails to negotiate ransom payments.
For a while, cybercriminals were quite active and targeted various companies in the financial, construction, agriculture, marketing, and technology sectors.
Russia vs Ukraine
In the landscape of digital conflicts, the confrontation between Ukraine and Russia is a battle not to be underestimated. Ukraine, a country waging a long-running war against Russian threats, has transformed into a major front in the war against cyberattack.
Russian Cyberattacks: A Constant Threat
Russia is known for its cyberattacks, which can disrupt everything from national security to the economy and public order.
Ukraine's Response
Faced with this ongoing threat, Ukraine has awakened. The country has developed a multi-layered counter-attack ,including the rapid strengthening of its cyber-defense forces.
Source: www.bleepingcomputer.com
