#raas
-
“Ransom Busters”: A Ransomware Affiliate Posing as Rescuers
Researchers at GuidePoint have found that a “post-attack recovery” firm is, in all likelihood, the author of those very attacks, trying to snatch the ransom out from under its own employers.
-
DOUBLECUP: a ClickFix service that hides malware in the browser's image cache
DOUBLECUP, a new Russian-language loader-as-a-service, conceals malicious code in PNG images cached by the victim's browser and delivers CountLoader and a new DeviceManager trojan.
-
DevMan Turned Extortion Into SaaS: A Single Portal for Affiliates
Switzerland's PRODAFT has described the web platform of the DevMan group, where affiliates build malicious payloads, negotiate with victims and collect payouts. A separate thread became the scandal around a Huntress employee who leaked FBI inquiries to the extortionists.