Description Summary
This is not a ransomware group but a data broker
Threat Actor
Data-broker/re-extortion operation ('Radar/Dispossessor'), led by 'Brain'; re-published data stolen by LockBit and others.
Technical Indicators
Encryption Extension
N/A — data broker (re-leaks other groups' data)
Encryption Algorithm
N/A — no encryption
Ransom Note Name
N/A
Targeted Industries
Cross-sector
First Seen
2024
Last Seen
August 2024 (FBI/international seizure of infrastructure)
Geographical Location
Worldwide
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |