Cybersec Firm Penetrates Ransomware Gang, Warns Potential Targets

The GudangMovies21 editors choose and evaluate products. independently If you purchase via affiliate links, we might receive commissions that assist in supporting us. testing .

A cybersecurity company breached an organization. ransomware gang by exploiting a flaw in the group's site on the dark web. Resecurity was able to spy Regarding the team's activities, reveal who they aimed to target, and inform both those individuals and law enforcement agencies.

The breach involves the BlackLock ransomware group, also known as El Dorado, which successfully attacked at least 40 organizations worldwide. The gang also had plans to recruit "affiliates" who would spread the ransomware to more victims.

(Credit: Resecurity)

In December 2024, Resecurity discovered a flaw stemming from improper configuration on the gang's website, which was frequently used for publishing data pilfered from their targets. Local File Inclusion A related vulnerability allowed the firm to recover the IP addresses associated with the network infrastructure supporting the group's data leak website. Additionally, they obtained the configuration files and account credentials.

Resecurity was then able to crack the accounts, giving the company a way to snoop on and hijack the gang’s infrastructure. The access exposed a logged history of commands the gang used when managing the server for the data leak site.

“Ironically, one of the passwords copied by one of the actors managing the BlackLock Ransomware server was valid for several other associated accounts used by the group,” Resecurity added in its report. The same access also exposed the email addresses the gang used for a file-sharing service called MEGA, which facilitated the group’s data theft from successful breaches.

(Credit: Resecurity)

In January, as it seemed BlackLock was about to release leaks indicating yet another successful breach, Resecurity started alerting officials and targets in Canada and France. The revealed IP addresses suggest that the group could potentially be operating from Russia and China; however, it’s also feasible that the BlackLock members were merely redirecting their online traffic through these locations. VPNs .

However, this month, BlackLock unexpectedly fell quiet. It seems another ransomware group named DragonForce took over and altered BlackLock’s website on the dark web, indicating that Resecurity was not the only entity to discover the flaw.

"It appears that DragonForce aimed to disgrace the group and disrupt their activities to get rid of rivals. Conversely, these strategies might have been employed as a 'false flag' operation to facilitate a shift towards a new initiative," Resecurity stated. The firm observed that the ransomware assaults carried out by both BlackLock and DragonForce exhibited overlapping segments of code. Additionally, on February 28th, a prominent member of BlackLock alluded to a potential "exit strategy" in an online discussion thread.

Nevertheless, Resecurity states that the severity of the vulnerability was such that BlackLock "endured considerable harm and seems improbable to recuperate, since their partners might now be hesitant to collaborate with them because of several operational security lapses."