On December 26, hackers from the BlackCat group reported on their underground website that they had successfully hacked into a financial services company.
Since the victim didn’t pay the ransom, the cybercriminals posted everything that was stolen, but created an artful “punishment” for the hacked company.
This is yet another creative way, as we have already seen in the past from BlackCat with The Allison and with our University of Pisa.
They then leaked the data on a site that almost completely copies the look and feel of the victim’s site. This had not been done in the past, but the data had been published on sites with the same domain with a different extension without the same graphic layout.
.png "BlackCat: Creative new ways to “shame” victims who don't pay ransoms 1")
Anyone can access the site, because it is public on the clearnet.
It is likely that this is how cybercriminals want to harm the victim even more, as they have not monetized their efforts by allowing everyone to access their data.
Now on the site you can find 3.5 GB of documents, including:
- Reminders to employees;
- payment forms;
- Employee information;
- Data on activities and expenses;
- Financial data of the victim’s customers;
- Passport scans from the victim’s clients.
Publishing data to a mirror site in the clearnet will be a much bigger problem for the victim company than disseminating data using sites on the onion network.
This new tactic will hopefully be picked up by other gangs as it is extremely effective at “shaming” victims.
BlackCat: Creative new ways to “shame” victims who don’t pay ransoms
