Notorious hacker group Evil Corp have found a simple trick to try and evade US sanctions – switching malware.

The Russia-linked group have begun using Lockbit, which works as a ransomware-as-a-service (RaaS). According to threat intelligence group Mandiant, a recent group of Lockbit attacks have been attributed to UNC2165, a group with numerous connections to Evil Corp.

This threat cluster was previously sanctioned by the US Treasury Department back in 2019. It stole over $10 million as part of a major campaign using the Dridex malware to infect hundreds of financial institutions around the world.

The sanctions meant that affected organisations couldn’t pay the ransoms demanded by UNC2165. While this cut off funds from the criminal group, it also prevented the victims from accessing their data and systems.

Mandiant noted that sanctions form part of the toolkit used by the US to tackle ransomware operations.

“These sanctions have had a direct impact on threat actor operations, particularly as at least some companies involved in ransomware remediation activities, such as negotiation, refuse to facilitate payments to known sanctioned entities. This can ultimately reduce threat actors’ ability to be paid by victims, which is the primary driver of ransomware operations,” it noted.

However, according to Mandiant, using the RaaS Lockbit makes it harder to attribute the attack to Evil Corp, helping the cybercriminals to evade sanctions.

“The adoption of an existing ransomware is a natural evolution for UNC2165 to attempt to obscure their affiliation with Evil Corp. Both the prominence of Lockbit in recent years and its successful use by several different threat clusters likely made the ransomware an attractive choice,” the group noted.

Evil Corp was behind a major cyberattack on GPS specialist Garmin. The hackers deployed software called WastedLocker to scramble Garmin’s data. This prevented users from syncing data from Garmin hardware and smartphone apps and accessing customer support services.

Reports suggest that, due to a lack of known weaknesses in WastedLocker, Garmin ultimately paid the ransom to Evil Corp, which had been set at $10 million.

It has used a variety of malware to pull off its attacks in the past. Since using WastedLocker, it moved on to the Hades ransomware, before using Lockbit.

However, in an additional twist, there are reports that the developers behind Lockbit are unhappy with its use by Evil Corp.

Lockbit has claimed to have hacked Mandiant in retribution for its post connecting the group to Evil Corp, stealing 350,000 files which they plan on leaking. Mandiant has denied that is had been hacked, and the provenance of data released by Lockbit has not been confirmed.

In part, Lockbit seems to be loathe to be connected with a high-profile and potentially politically motivated hacking group.

“We are real underground darknet hackers, we have nothing to do with politics or special services like the FSB, FBI and so on,” a statement from the group read.

Recommended

• Comment | How off-the-shelf AI can give businesses an advantage
• 5 of the biggest cloud security challenges
• Cyber skills boost as apprenticeship programme gains NCSC certification

Cybercriminal gangs have often had to reinvent themselves, driven as much by success as failure. REvil’s rise and fall represents a cautionary tale for hackers.

After pulling off several high-profile ransomware attacks in 2021, such as the Kaseya and Colonial Pipeline hacks, they were hit by several arrests, including a rare intervention by Russian authorities.

However, this story bares many similarities to the story of REvil’s predecessor, GandCrab. It too drew too much attention to itself, it disbanded and reformed as REvil.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.