(Celal Güne?/Anadolu Agency via Getty)
The FBI has dismantled servers and websites controlled by the Dispossessor ransomware gang.
Federal agents have replaced Dispossessor’s main site with an FBI seizure notice announcing that the domain had been "repossessed," in a dig at the group’s name.
Dispossesssor is a relatively new cybercriminal outfit; it emerged only a year ago, according to the FBI. Still, the gang has been quick to attack numerous targets, including many small to medium-sized businesses in sectors such as education, healthcare, and finance.
(Credit: FBI)Initially, Dispossessor operated more as a “data broker” by threatening to leak confidential data that other hackers had stolen. “Since no instances of their ransomware have been observed, it is clear that they are primarily publishing data leaks from other groups, including those that are now defunct or have been shut down. This makes them opportunistic threat actors,” cybersecurity vendor SOCRadar said in May.
(Credit: ransomlook.io)But it looks like the group has since resorted to launching their own ransomware attacks. The FBI says the Dispossessor gang has racked up at least 43 victim companies based in Argentina, India, the UK, and the United Arab Emirates, among other countries.
The group ”identified vulnerable computer systems, weak passwords, and a lack of two-factor authentication to isolate and attack victim companies,” the FBI said. They then spread ransomware to the victim’s IT network, encrypting the computers and locking the systems down unless a ransom was paid.
It’s unclear how the FBI identified the group’s criminal infrastructure. But federal investigators dismantled 24 servers belonging to the group, including three in the US.
The FBI also didn’t mention even if any arrests were made. But investigators say a member called “Brain” leads the group. The FBI is encouraging the public to contact the agency with any information about the cybercriminal gang to help shut it down.
“As ransomware can have many variants, such as this case, the total number of businesses and organizations affected is yet to be determined,” the FBI added.