{ "id": "70da20f9-924e-4d55-84b4-d803b03e20e9", "created_at": "2026-04-06T00:13:51.433134Z", "updated_at": "2026-04-10T13:12:02.397055Z", "deleted_at": null, "sha1_hash": "5ce8789d416b9d649fed96671fb0cb7931a1f627", "title": "Ransomware criminals look to other hackers to provide them with network access", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 369156, "plain_text": "Ransomware criminals look to other hackers to provide them with\r\nnetwork access\r\nBy Rene Millman\r\nPublished: 2021-06-17 · Archived: 2026-04-05 15:25:59 UTC\r\nAccording to a new report, cyber criminals distributing ransomware are increasingly turning to other hackers to\r\nbuy access into corporate networks.\r\nResearchers at Proofpoint said a “robust and lucrative criminal ecosystem” exists where criminals work together\r\nto carry out ransomware attacks. In this ecosystem, ransomware operators buy access from independent cyber\r\ncriminal groups who infiltrate major targets for part of the ransom proceeds.\r\n“Cyber criminal threat groups already distributing banking malware or other trojans may also become part of a\r\nransomware affiliate network,” said researchers.\r\nThe researchers tracked ten threat actors acting as initial access facilitators or likely ransomware affiliates. They\r\nalso found there is not a one-to-one relationship between malware loaders and ransomware attacks. Instead,\r\nmultiple threat actors use the same malware payloads for ransomware distribution.\r\nLatest Videos From IT Pro\r\n“Ransomware is rarely distributed directly via email,” the report said. “Just one ransomware strain accounts for 95\r\npercent of ransomware as a first-stage email payload between 2020 and 2021.”\r\nThe hackers who offer access compromise organizations via first-stage malware like The Trick, Dridex, or Buer\r\nLoader. They will then sell their access to ransomware operators to deploy data theft and encryption operations.\r\nResearchers said banking trojans – often used as ransomware loaders – represented 20% of malware seen in\r\nnamed campaigns in the first half of 2021, making it the most widespread malware type the company sees in the\r\nlandscape.\r\nSign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI,\r\ncybersecurity and other IT challenges as per 700+ senior executives\r\nRELATED RESOURCE\r\nhttps://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network\r\nPage 1 of 3\n\nFour ransomware resiliency challenges you can combat with confidence\r\nThe benefits of a multi-layered security solution\r\nFREE DOWNLOAD\r\nResearchers also saw evidence of ransomware deployed via SocGholish, which uses fake updates and website\r\nredirects to infect users, and via the Keitaro traffic distribution system (TDS) and follow-on exploit kits that\r\noperators use to evade detection.\r\nIn the course of investigations into this ecosystem, researchers tracked several hackers operating as initial access\r\nfacilitators.\r\nTA800 is a large cyber crime actor Proofpoint has tracked since mid-2019. This threat actor attempts to deliver\r\nand install banking malware or malware loaders including The Trick, BazaLoader, Buer Loader, and Ostap.\r\nhttps://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network\r\nPage 2 of 3\n\nTA577 is a prolific cyber crime threat actor Proofpoint has tracked since mid-2020. This actor conducts broad\r\ntargeting across various industries and geographies. Proofpoint has observed TA577 deliver payloads including\r\nQbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike. Researchers said that TA577 is associated with\r\nthe March 2021 Sodinokibi ransomware infection.\r\nAccording to researchers, with the US government proposing new efforts to combat ransomware, “it is possible\r\nwith new disruptive efforts focused on the threat and growing investments in cyber defense across supply chains,\r\nransomware attacks will decrease in frequency and efficacy.”\r\nSource: https://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network\r\nhttps://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia" ], "origins": [ "web" ], "references": [ "https://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network" ], "report_names": [ "ransomware-criminals-look-to-other-hackers-to-provide-them-with-network" ], "threat_actors": [ { "id": "cf32661e-7543-4b57-8665-7f8101a000e9", "created_at": "2023-01-06T13:46:39.322379Z", "updated_at": "2026-04-10T02:00:03.287241Z", "deleted_at": null, "main_name": "TA800", "aliases": [], "source_name": "MISPGALAXY:TA800", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "b4f83fef-38ee-4228-9d27-dde8afece1cb", "created_at": "2023-02-15T02:01:49.569611Z", "updated_at": "2026-04-10T02:00:03.351659Z", "deleted_at": null, "main_name": "TA577", "aliases": [ "Hive0118" ], "source_name": "MISPGALAXY:TA577", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "22d450bb-fc7a-42af-9430-08887f0abf9f", "created_at": "2024-11-01T02:00:52.560354Z", "updated_at": "2026-04-10T02:00:05.276856Z", "deleted_at": null, "main_name": "TA577", "aliases": [ "TA577" ], "source_name": "MITRE:TA577", "tools": [ "Pikabot", "QakBot", "Latrodectus" ], "source_id": "MITRE", "reports": null } ], "ts_created_at": 1775434431, "ts_updated_at": 1775826722, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/5ce8789d416b9d649fed96671fb0cb7931a1f627.pdf", "text": "https://archive.orkl.eu/5ce8789d416b9d649fed96671fb0cb7931a1f627.txt", "img": "https://archive.orkl.eu/5ce8789d416b9d649fed96671fb0cb7931a1f627.jpg" } }