Learn More. Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support. Stop email threats others miss and secure your organization against the 1 ransomware attack vector.
Two newcomers have made their way onto the ransomware threat group stage, becoming the biggest threat to the energy and utilities sector in Each emerged from LockBit's shadow in the second half of after law enforcement disrupted LockBit's operation in February LockBit was a formidable ransomware-as-a-service RaaS provider and among the most active worldwide, measured by the number of victims claimed on its Dark Web site.
Hunters International is a RaaS operator that first appeared in October , not long after law enforcement took down the RaaS group Hive. Hunters denies any connection, but it does use Hive's source code and infrastructure, which it claims to have acquired on its own.
The group operates widely and does not focus on specific industries, although it is a prominent player against energy and utility suppliers. The one area the group, which primarily communicates in English and Russian, is picky about is its avoidance of targets in the former Commonwealth of Independent States. Be that as it may, Hunters now operates a mixed bag of ransomware attacks, sometimes conducting double extortion attacks and combining data theft with encryption, but more often just exfiltrating the data.
It selectively excludes certain files, folders, and extensions from encryption, such as critical system files e. Initially launched as "Agenda" in July , the group rebranded as "Qilin" two months later.
