RedCurl’s Ransom Ruckus: Russian Hackers Shift Tactics with QWCrypt, Leaving Cyber Sleuths Baffled
RedCurl, a Russian-speaking threat actor, is now using QWCrypt ransomware to target hypervisors, a strategic shift from their typical corporate espionage. Bitdefender speculates RedCurl might be a ‘gun-for-hire’, using ransomware as a diversion or a backup plan when contracts aren’t paid. Their revenue model and true motives remain mysterious.
Hot Take:
Just when you thought cybercriminals couldn’t get any sneakier, RedCurl turns up with ransomware that targets hypervisors! They’re the ninjas of the digital underworld, quietly backflipping through your virtual environments while wearing a cloak of mystery. The real question is, are they the Robin Hoods of ransomware or just another cyber mercenary squad pulling off a heist without leaving a trace?
Key Points:
- RedCurl, also known as Earth Kapre or Red Wolf, has been active since 2018.
- The group recently shifted tactics, deploying a new ransomware called QWCrypt.
- They mainly target organizations in the US, but victims have also been spotted in Germany, Spain, and Mexico.
- RedCurl focuses on encrypting hypervisors, leaving network gateways operational.
- Their true motivations and business model remain a mystery, leading to speculation about their ‘gun-for-hire’ status.
Already a member? Log in here