15 Ransomware Gangs Declare End of Operations on BreachForum

An unusual announcement is currently causing a stir in the IT security world: 15 notorious ransomware groups, including Scattered Spider and Lapsus $, explained their activities at the Breachforum underground forum.

Golden parachute

In the future there should be no attacks in your name. The criminals stated that they had achieved their goals. According to the self -expression, they were never concerned with funds, but about showing serious security gaps. “Silence will now be our strength,” says the statement according to a report by the British magazine The Register. In addition, the groups announced that the members withdraw to private individuals: some participants wanted to enjoy their fortune, which they accumulated with their ransomware campaigns – there was talk of a “golden parachute”. Others want to continue to improve IT systems – but in secret.

Most recently, the groups had made headlines with attacks on prominent destinations such as the car manufacturer Jaguar and the British retail chain Marks & Spencer. At the same time, there are increasing indications that several participants have already been arrested. In their forum entry, the backers threatened not to accept the arrests: they wanted to use their own skills to “humiliate those who have humiliated us”.

At the same time, the gangs admitted that there could still be cyber attacks that would be attributed to them even after the withdrawal. However, these were planned and carried out before the official “retirement declaration”. This shows that the whole thing could not be as edited as it sounds.

Is that right?

Safety researchers doubt that the decision means an actual end. In the past, it was common practice that cybercrime groups give up their old identities in order to later continue under new names and with slightly changed methods. “It is extremely unlikely that leading heads of these networks will really get out,” says an industry comment. In general, there are very few examples in history in which criminals have been satisfied with a certain captured wealth and have thus calmed down.

If someone has not been caught by the authorities, in most cases greed will in most cases try to get a little more. For companies and authorities, the risk of ransomware remains high anyway. Even if individual groups should actually pause or stop, new mergers of cybercriminals are constantly being created. Experts therefore strongly advise you to regularly test their own systems, to test backups regularly and to train employees in dealing with phishing attacks.