Ransom Mafia – Analysis of the World’s First Ransomware Cartel

by Jon DiMaggio - Chief Security Strategist

In February 2021, a multinational law enforcement task-force arrested several Ukrainian men for supporting a long-standing ransomware gang known as Twisted Spider1. First seen in May 2019, the gang was behind high-dollar enterprise ransomware attacks. Unfortunately, the arrests in February had little impact; Twisted Spider continued their operations several weeks later in March 2021. Twisted Spider often makes headlines, but it’s not only due to their attacks. In June 2020, the gang put out a press release, claiming they joined forces with several other well-known ransomware attackers to create a criminal cartel. If true, this collaborative partnership would pose a far greater threat to the community than attacks from smaller individual gangs by themselves.

Jon DiMaggio

Chief Security Strategist

Jon DiMaggio is the chief security strategist at Analyst1 and has over 15 years of experience hunting, researching, and writing about advanced cyber threats. As a specialist in enterprise ransomware attacks and nation-state intrusions, such as "Ransom Mafia: Analysis of the World’s First Ransomware Cartel",

"Nation-State Ransomware" and a "History of REvil". He has exposed the criminal cartels behind major ransomware attacks, aided law enforcement agencies in federal indictments of nation-state attacks, and discussed his work with The New York Times, Bloomberg, Fox, CNN, Reuters, and Wired. You can find Jon speaking about his research at conferences such as RSA. Additionally, in 2022, Jon authored the book "The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime" published by No Starch Press.

Continue reading