Recent findings reveal that security vulnerabilities in the infrastructure used by ransomware gangs have inadvertently protected six companies from potential cyberattacks. According to security researcher Vangelis Stykas, these loopholes in the cybercriminals' web structure thwarted their attempts to extort significant ransom payments.
Among the protected entities were four cryptocurrency firms, which received timely warnings before ransomware actors could encrypt their files. Additionally, two unicorn companies were able to secure their data using decryption keys provided by Stykas, thus avoiding ransom payments. This incident highlights a rare but significant success for the targeted organizations.
Stykas, Chief Technology Officer and security researcher at Atropos.ai, discovered several fundamental vulnerabilities in the web dashboards of at least three ransomware gangs. These flaws were substantial enough to disrupt the core operations of the gangs.
Cybercriminals typically obscure their identities and operations behind the Dark Web, utilizing tools like the Tor browser to hide their real-world servers and data storage. However, Stykas uncovered critical security flaws in the attackers' leak sites, which are used to extort victims and publish stolen information. These flaws allowed him to identify the vulnerabilities without logging into the sites.
One notable vulnerability involved the Everest ransomware gang, which used a default password for accessing their back-end SQL databases. This oversight exposed their file directories and API endpoints, revealing the targets of the BlackCat ransomware gang.
Additionally, Stykas exploited an insecure direct object reference (IDOR) bug to review chat messages from the Mallox ransomware administrator. He discovered two decryption keys, which he subsequently shared with the affected companies. For privacy reasons, he chose not to disclose the names of the companies involved.
This case underscores the potential for security lapses in cybercriminal operations to inadvertently benefit their intended victims.
๐๐ญ๐๐ฒ ๐ข๐ง๐๐จ๐ซ๐ฆ๐๐ ๐ฐ๐ข๐ญ๐ก ๐จ๐ฎ๐ซ ๐ฅ๐๐ญ๐๐ฌ๐ญ ๐ฎ๐ฉ๐๐๐ญ๐๐ฌ ๐๐ฒ ๐ฃ๐จ๐ข๐ง๐ข๐ง๐ ๐ญ๐ก๐ WhatsApp Channel now! ๐๐ฒ
๐ญ๐๐๐๐๐ ๐ถ๐๐ ๐บ๐๐๐๐๐ ๐ด๐๐ ๐๐ ๐ท๐๐๐๐ฌ ๐ Facebook, LinkedIn, Twitter, Instagram
