skip to Main Content

At The Identity Organisation, we're here to help!

    Your privacy is important to us, and we want to communicate with you in a way which has your consent and which is in line with UK Law on data protection. As a result of a change in UK law on 25th May 2018, by providing us with your personal details you consent to us processing your data in line with current GDPR requirements.

    Here is where you can review our Privacy & GDPR Statement

    To remove consent at any time, please e-mail with the word "unsubscribe" as the subject.

    +44 (0) 1628 308038

    What’s in a (Ransomware Gang) Name? (A Gang by Any Other Name is Just as Dangerous)

    What's in a Ransomware Gang

    The shutting down or even retirement of one ransomware gang seems to result in another popping up. Are these new gangs or just reincarnations of the old one with a new face?

    Recently, we saw Darkside ransomware get shutdown in May and new player BlackMatter appear to be using the same algorithms. Leading industry analysts believe it’s the same group, but there are more ties to Darkside than just BlackMatter. If you follow the path back far enough – pointed out by Brian Krebs – it’s entirely possible that Cerber in 2016 became Gandcrab in 2018, who became Sodinokibi in 2019, who then became REvil in 2020, who morphed into Darkside, and finally BlackMatter.

    So, what’s the point of all this cloak and dagger name changing, anyway?

    In some cases as I pointed out in the previously linked article on Darkside, sometimes it’s about separating the operation from a previous focus (critical U.S. infrastructure in Darkside/REvil’s case) in order to be hopefully “left alone” by the U.S. Government. In other cases, it’s just like any other merger/acquisition, where a new entity is formed. We saw that with a number of ransomware gangs sharing code, techniques, and infrastructure.

    It also could be a means by which to launch a completely new set of ransomware code with sunsetting the old code. Case in point, the only thing tying BlackMatter to Darkside/REvil currently is some matching algorithms – it’s possible that an improved evolution of code now exists and an old algorithm still provided the necessary value.

    One thing is certain, regardless of what the circumstances are behind a name change you can be certain it’s intended on helping the ransomware gang refocus and be more successful at taking your organization’s money.

    Free Ransomware Simulator Tool

    Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

    KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.


    Here’s how it works:

    • 100% harmless simulation of real ransomware and cryptomining infections
    • Does not use any of your own files
    • Tests 21 types of infection scenarios
    • Just download the install and run it 
    • Results in a few minutes!

    PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser:

    Sign Up to the TIO Intel Alerts!

    Back To Top