As if it was not enough to infect victims’ computer systems with malware and threaten to leak the stolen data, ransomware group Conti is now selling access to its victims’ systems to other cyber threat actors.
Cybersecurity blog KrebsOnSecurity first noticed the ransomware group’s new “business” earlier this week, noting that the group had updated its online blog to show that it was now selling the data it had stolen from its latest round of victims.
“We are looking for a buyer to access the network of this organization and sell data from their network,” the Conti group’s message read, inserted into multiple victim listings which the ransomware gang have put up for sale.
It is currently unclear what the Conti gang hopes to achieve with selling access to its victims’ data. Security experts have also questioned why the gang would openly advertise having hacked into companies if they plan to sell that very access to other threat actors, since such a move tips off the victims that they were hacked.
“I wonder if they are about to close down their operation and want to sell data or access from an in-progress breach before they do,” commented Emsisoft chief technology officer Fabian Wosar. “But it’s somewhat stupid to do it that way as you will alert the companies that they have a breach going on.”
KrebsOnSecurity suggests that Conti’s new venture is likely another play to force victims into negotiating for the data; somewhere along the lines of “pay up or someone will pay for your data or long-term misery if you don’t.” The blog has also suggested that Conti might be outsourcing the data exfiltration side of the business – in exchange for a cut of the profits – so that it can focus more on deploying ransomware.
