From Espionage to Extortion: Emperor Dragonfly’s Ransomware Rampage
Emperor Dragonfly, a China-based threat actor, has swapped espionage for ransomware, demanding $2 million in a cyber attack. Symantec researchers suggest these state-backed hackers might be moonlighting for extra cash, proving that even cybercriminals need side hustles.
Hot Take:
When life hands you espionage tools, why not moonlight as a ransomware artist? Emperor Dragonfly, the cybercriminal equivalent of a double agent, is now strutting its stuff in the world of ransomware with the flair of a Bond villain. Who knew that cyber espionage tools could have a side hustle?
Key Points:
- Emperor Dragonfly, a China-based threat actor, has been linked to both espionage and ransomware activities.
- The group used a toolset traditionally associated with espionage in a $2 million ransomware attack.
- Researchers observed an overlap between state-backed espionage groups and cybercrime operations.
- The attack involved a variant of the PlugX backdoor and exploited known vulnerabilities in Palo Alto PAN-OS.
- Symantec’s report provides indicators of compromise to help defenders detect and mitigate such attacks.
Already a member? Log in here