TRACKING ADVERSARIES: EVILCORP, THE RANSOMHUB AFFILIATE

Summary from the TLDR InfoSec newsletter

EvilCorp and RansomHub are cybercriminal groups linked through tactics and tools that pose a significant ransomware threat. EvilCorp, sanctioned since 2019, uses SocGholish malware for attacks, while RansomHub offers Ransomware as a Service (RaaS) operated by Russian-speaking actors. Their affiliation may result in sanctions on RansomHub, affecting victims, cyber insurance, and law enforcement actions.