The 10 most notorious cyber crime gangs in the world
Roughly four in five breaches emanate from organised crime.[i]
Cyber crime has escalated dramatically over the past few years with sophisticated criminal gangs leveraging world events to create chaos.
The current spike began during the COVID-19 pandemic when there was a mass shift of employees working from home. This meant many employees were using their own devices and did not have enough cyber security protection to stop malware. Further, gangs also targeted employees via phishing scams that leveraged COVID-19 misinformation.
More recently, the Russian invasion of Ukraine has resulted in a subsequent cyber-war. This has seen Russian attackers targeting Ukraine ally businesses and government infrastructure in a bid to weaken the defenders.
This has resulted in the growth of sophisticated cyber gangs. These infamous gangs are coordinated, strategic, and some have even amassed large followers. However, like their ‘famous counterparts’ infamous gangs can also fall from grace.
Below we list the current most dangerous cyber crime gangs that business owners need to look out for. (Note, gangs are not in any particular order)
Conti was a powerful cyber gang believed to have originated in Russia in 2020. The gang had an impressive following and was previously considered one of the largest threats to business and governments. However, in March 2022, the formidable gang posted its support of the Russian invasion of Ukraine. Days later, the gang lost most of its online support. Despite this, experts state the gang is still influential and is undergoing a ‘rebrand’.[ii]
BIGGEST KNOWN ATTACK: Costa Rica Government May 2022: the gang encrypted systems from multiple government bodies causing the country’s president to declare a national state of emergency.
CYBER ATTACK STRATEGY: Phishing emails to companies to download aggressive ransomware.
#9: REvil
The REvil model primarily uses Ransomware-as-a-Service (RaaS). Providers of RaaS rely on other hackers to distribute the ransomware and then they receive a ‘cut’ of the extortion fee. This is roughly 20%-30%. IBM Security X-Force states that REvil targets wholesale, manufacturing, and professional services industries. Further, the group focus on attacking US, UK, Australia and Canada.[iii]
BIGGEST KNOWN ATTACKS: JBS meat processing attack which affected the global beef supply chain and a $50m ransom for technical data stolen from Quanta Computer in Taiwan.
SideCopy was first noticed in 2020 and appears to be following in the footsteps of the now dormant Syrian Electronic Army. SideCopy is believed to be a Pakistani Threat Actor. The group has targeted both Afghan and Indian governments. The gang uses a range of attacks but focuses on targeting personnel working in government organisations to convince them to open/download malicious files. The gang also uses platforms like Facebook to connect with its victims.
BIGGEST KNOWN ATTACK: Continuous attacks on the Indian Government.
CYBER ATTACK STRATEGY: Sophisticated targeted phishing and social engineering to trick the user into downloading a malicious payload.
#7: Clop (aka Cl0p)
Like many cyber gangs, Clop was first cited in 2019 but grew in 2020 by preying on entities that deal with highly sensitive information such as the healthcare and finance industries. The group focus on a double-extortion strategy. This means after they gain access to data, they demand a ransom for the data to be decrypted, as well as demand a fee for the data to not be released publicly.
Clop has also been known to perform repeat attacks on businesses that have weak cyber security and don’t upgrade their system after an attack.
BIGGEST KNOWN ATTACK: $23m ransom on German software giant AG, one of the 10 largest software vendors in Europe.
CYBER ATTACK STRATEGY: Spear-phishing emails and exploiting old programs to discover vulnerabilities in order to upload ransomware.
#6: Cosmic Lynx
This Russian based gang targets businesses worldwide by compromising corporate email accounts (known as Business Email Compromise (BEC)) and pretending to be the CEO or a business executive. The cyber gang seems to focus on law firms, the education sector, and larger businesses. In each scenario, the gang employs a dual impersonation scheme. They then create a sophisticated story regarding a merger or business expansion. Leveraging multiple ‘credible’ accounts, the hacker then convinces the employee to give the hacker access to financial accounts and/or to download malicious files.
BIGGEST KNOWN ATTACK: The group focuses on smaller attacks and is known for its high earnings of US$1.27m per BEC attack. This is phenomenally higher than the global average of $80k per BEC attack.[iv]
CYBER ATTACK STRATEGY: BEC: the gang impersonates high-level executives to trick employees into compromising company security.
DarkSide is a Russian-linked cyber crime gang. The group offers ‘ransomware-as-a-service, carrying out attacks on behalf of other criminals. “DarkSide’s services include providing technical support for hackers, negotiating with targets like the publishing company, processing payments, and devising tailored pressure campaigns through blackmail and other means, such as secondary hacks to crash websites.”[v]
The gang typically focuses on larger companies that are more likely to pay large ransom fees. However, they still pose a potential threat to smaller businesses that may be affiliated with the larger targets.
BEST KNOWN FOR: The US Colonial Pipeline ransom attack in May 2021.
Evil Corp is a well-established cyber gang since circa 2009. The Russian-based leaders of Evil Corp allegedly live ‘millionaire’ lifestyles due to their ability to extort more than $100m from corporate victims.[vi]
The gang is not only highly organised, but continuously leverages new technology to outsmart victims and evade authorities. Over the past 12 years they have used strategies such as macro viruses, malicious photo attached to phishing emails, trojan targeting the banking industry, brute-force attacks, clickbait, and recently, leveraging Ransomware as a Service.
BEST KNOWN FOR: global expansion of it’s malware, stealing $100m across more than 40 countries.
CYBER ATTACK STRATEGY: Various, currently the most common is Ransomware-as-a-service (Raas)
The LockBit 3.0 cyber gang is effective, efficient, and highly active. The group continues to strategise to reinvent themselves, enabling them to leverage system vulnerabilities. The group also employs a ‘bounty program’ offering rewards ranging from $1,000 to $1 million to individuals who find exploits, personal data on potential victims, information on high-value targets, or ideas for improving the operation.[vii]
BEST KNOWN FOR: Stealing 78GB of data from Italy’s tax agency and demanding ransom for safe return.
Lapsus$ is a new gang in the market that focuses on data theft and extortion. As a new group, the gang is not as organised as its experienced counterparts, but leaders rose to fame for compromising Microsoft. The gang also breached Samsung and Nvidia. In March 2022, seven group leaders were arrested in London. However, the Lapsus$ attacks continued after the arrest showing that the gang is still active and growing.
BEST KNOWN FOR: Breaching Microsoft’s systems via social engineering
CYBER ATTACK STRATEGY:data theft of confidential files and extortion
#1: FIN7
Since 2012, FIN7 has been a powerhouse cyber ‘villain’. The sophisticated Russian gang operates like a business using multiple strategies to leverage stolen data. Like many of the advanced gangs, FIN7 continues to evolve its strategies to stay ahead of authorities and victims with outdated systems. The gang focuses on obtaining customer credit card records via compromising point of sale tools and e-commerce sites. They then maximise the financial return of the data by: a) asking the company for a ransom for the data back, b) threatening victims who they have the credentials of c) selling the confidential data to a third party. The group is thought to have amassed billions of dollars via its cybercrimes.
BEST KNOWN FOR: Spear phishing campaign targeting United States Securities and Exchange Commission (SEC) filings in order to steal highly confidential business information that could be monetarised.
CYBER ATTACK STRATEGY: evolving, but focused on gaining consumer credentials via vulnerable ecommerce systems.
We have been with Jam Cyber for years and we couldn't be happier. Their cyber security is second to none. Each month they also send out training videos to advise what to look out for with cyber threats being everywhere these days. If you want everything fully protected, I strongly suggest signing on with Jam Cyber - Max Sollmer - General Manager - Storm Support Services
Allison B.
1730347316
The team have been assisting us for 10+ years with IT and cybersecurity issues.
Sh D.
1730336351
Easy to communicate with and very professional.
Tom W.
1729147183
Professional, responsive and good to deal with.
Vee B.
1729123903
Always a great experience! Fast and easy fix with Kurt. thank you JamCyber.
Victoria B.
1728951698
Great individualised service.Ferdinand took the time to work through the process with me and customise the prompts to work for our business.
Nathan D.
1726536170
Jasper was very responsive and helpful when it came to setting up my work laptop
Rami F.
1723670821
Michelle R.
1723185702
The team actioned my Citrix issue the same day. They were courteous enough to contact me via call and email to let me know they are about to connect and work on the issue. I watched how Jasper (the tech) sorted and resolved it right away. He even made sure all is good before he jumped off the chat. Thank you.
Marie M.
1722995084
I am grateful for the help that Kurt D. provided to immediately resolve the issues my work laptop was having. He was patient and committed to find the solution. He did a great job.
Katrina De C.
1721340073
Highly recommend Jimmy and Jam Cyber. They have helped our firm for years they go above and beyond and resolve every issue we have in a timely manner, can always count on them to be there to help when needed.
Hannah M.
1721101624
quick communication and friendly staff.
John V.
1720685063
Excellent service from Dianne. She very patient and knowledgeable and resolved the issues. Thank you! Highly recommend using Jam Cyber.
Israel A.
1720499049
I am extremely satisfied with the IT support I received in resloving my internet connection issue. The response was prompt, and Jasper was incredibly knowledgeable and professional. He patiently guided me through each step. My connection is now stable. I highly recommend their services to anyone in need of technical assistance.
Managers M.
1719883966
Jamcyber have been super helpful with our migrations and IT support.very professional and quick responses to our requests for assistance with our cyber security.
Peter T.
1718759377
Jimmy at Jam Cyber Security is absolutely fantastic! He has been helpful and informative and always has a professional and positive attitude in the work that he does.
Manuela G.
1718756108
The team at Jamcyber and Cyber security are absolutely amazing! They have assisted me with all technical, IT and security related matters in an efficient manner. I would highly recommend Jimmy and the team for all IT and security needs.
Mary Ann Dela C.
1718166047
Jam Cyber is very reliable cybersecurity solution. Its clear instruction and skyrocket effectiveness in threat detection and strong customer support, make it an excellent choice for small to medium-sized businesses. Their comprehensive protection and ease of use justify the investment. Highly recommended for businesses seeking a dependable cybersecurity solution.
Joyce N.
1717715588
Ferdie is an extremely friendly, professional person to deal with. It is always a pleasure to have him help me through my issues.
Kate Aubrey B.
1717473111
Jam has been a very helpful for our company's cybersecurity. Very approachable team plus has deep understanding of the latest threats have kept our systems secure and our data protected. The level of service and support we receive is great. Recommend them for any cybersecurity needs! Thanks, Jam Team!
Adellie L.
1717403027
The tech support team was fantastic. They were responsive and knowledgeable. I highly recommend their reliable and efficient support services. Thank you Dianne and Jimmy for the outstanding help!
Sarah Y.
1716863678
Jimmy Gao from Jam Cyber is great - he is very responsive, quick to resolution and knowledgeable. I would higher recommend Jimmy for all your IT and cyber security needs.
Sharon D.
1716532992
Without Jimmy we could not function. He has the answer to all our IT questions and solves every problem we face. And it's all done with a smile!
Owen C.
1716505410
Jimmy from Jam Cyber is extremely helpful and professional. He has been dedicated and attentive in resolving our issues and always carry’s a positive attitude.
Dy-ell H.
1715819414
Jam Cyber have been extremely helpful. A big shout out to Jimmy Gao who is always ready and able to help. He definitely makes our jobs easier and smoother, especially with the new system upgrade we just rolled out. It would not have been possible without him.
Gabriella K.
1715817166
Jimmy at Jam Cyber is amazing! He has put in a lot of time and effort in transitioning our business to a new cloud based platform. He is attentive and resolves issues with minimal fuss. Highly recommend Jimmy for your IT needs.
Ben and Elissa O.
1715816587
Jimmy Gao at Jam Cyber is professional, responsive and incredibly knowledgeable. Our firm is lucky to work with Jimmy who always provides top quality support and has really helped us with our IT projects and cyber security. I highly recommend Jimmy and the Jam Cyber team.
James T.
1712263326
Jamcyber has provided The Dataline Group with specialist IT support for many years. We always receive prompt service and we always obtain the right outcome, thanks to the knowledge and expertise of Ian and Ferdinand. I recommend this business.
Tong T.
1712193363
Jimmy completed a comprehensive review of our current set up and provided a cost effective solution that met our needs.Very friendly and easy to deal with
Calvin N
1710807031
Professional and reliable service. Resolved all my problems quickly.
jsf
1710803278
We engaged their services for a comprehensive suite of IT solutions, encompassing email hosting, IT support, and office network file sharing. Their responsiveness and professionalism were exemplary, earning our highest recommendation.
LooMate
1707428062
I've been with Jam Cyber for 15 years and love dealing with Markus and Ian and all staff. Best value in Australia.
Jasmine H.
1707373439
Jamcyber has been great with our cyber security roll out and migration to Microsoft 365.Jimmy and the team is very knowledgeable and quick to respond. It is good to have a support that you can actually talk to over the phone. Highly recommended.
Irene W
1701390148
Balance Insurance - Jam cyber has been a big help with my cyber security and voip services. Jimmy and his team is always quick to respond and professional. highly recommended.
Karen R.
1700477039
Excellent IT support & cyber security. Highly recommend - fast response time & professional service.
Tania M.
1699585073
Jam cyber helped me quickly and effortlessly with my IT issue.
Elissa Z.
1698974121
Jam Cyber has provided us with exceptional IT services for years now. Jimmy from Jam Cyber is professional, responsive and very knowledgeable across all things to do with our IT needs. Jam Cyber assists with all aspects of IT at including cyber security and selecting the best hardware for our firm.
Dana S.
1698371121
Awesome quick response always! Jam Cyber help us with Cyber Security and IT for our firm! Very helpful and always available!
Andrew F.
1674511498
We highly recommend the services of Jam Cyber who have been managing all of our IT and Telecommunications plus Cybersecurity for over 12 years. The team at Jam Cyber have been amazing, their systems and procedures have kept our IT operations running smoothly the entire time and their response timing and availability has been excellent.Thanks and regards,Andrew FinlaysonManaging Director Carrington Property Group
christopher K.
1659684395
We have used Jam Cyber for 8 years and been very happy with their service. They have been there when we needed them
Yvonne C
1658959147
Competent, confident, consistent, caring. Markus, Jimmy (and now Ferdi, Blair, May) and the team's level of service has not waned since 2012; they treat their customers, regardless of size, with integrity and professionalism. The picture included here is non IT/techie because although the team "live and breath" IT, they know how to speak to non-IT/techies.
Ronique L.
1657840907
Golden Age has used Jam Cyber for the last 2-3 years to support our cyber security and IT needs. They have always been responsive and solved any problems that came up. Would recommend!
Sharon P.
1655956894
The team are very knowledgeable and are always very helpful. Highly recommended.
Simone H.
1649560212
I can't recommend Markus, Jimmy, John, Ferdie and the team at JamCyber more highly. Cyber security and functioning IT solutions are vital for the day to day operation of my legal practice and JamCyber is across it all. The team is always very responsive, lovely to deal with, efficient and communicate clearly (they don't speak "IT" and expect we'll always follow). They're simply the best.
Samantha H
1647995235
Jimmy and the team at Jam Cyber are so knowledgeable, reliable and quick to respond to any issue, big or small. Jimmy in particular has been great to deal with - I highly recommend him and his team for IT support services.
Vania H.
1646112210
When I first started my legal practice, I had very little idea about cyber security and what is required. Markus and the team and Jamcyber walked me through everything and set it up perfectly. If I have anything done, like I need a new email set up or onboarding of a new staff member, they’re onto it, as soon as possible – it’s seamless. These guys know IT and they know cyber security – they’re also the best I’ve come across. If you want the best, use Jamcyber for everything IT-related.
Uma D.
1640053418
Jimmy from JamCyber is extremely helpful. He is very pleasant, patient and always gets the job fixed quickly. Thank you!
PE Family L.
1640047896
Jam cyber has greatly assisted us with our cyber security and it has been a great pleasure working with them
Kelly D.
1639107821
Jimmy and the team at Jam Cyber are always helpful and easy to deal with.
Carole W.
1639102760
Always great doing business with Jimmy and the team at Jam Cyber.
The 10 most notorious cyber crime gangs in the world
Roughly four in five breaches emanate from organised crime.[i]
Cyber crime has escalated dramatically over the past few years with sophisticated criminal gangs leveraging world events to create chaos.
The current spike began during the COVID-19 pandemic when there was a mass shift of employees working from home. This meant many employees were using their own devices and did not have enough cyber security protection to stop malware. Further, gangs also targeted employees via phishing scams that leveraged COVID-19 misinformation.
More recently, the Russian invasion of Ukraine has resulted in a subsequent cyber-war. This has seen Russian attackers targeting Ukraine ally businesses and government infrastructure in a bid to weaken the defenders.
This has resulted in the growth of sophisticated cyber gangs. These infamous gangs are coordinated, strategic, and some have even amassed large followers. However, like their ‘famous counterparts’ infamous gangs can also fall from grace.
Below we list the current most dangerous cyber crime gangs that business owners need to look out for. (Note, gangs are not in any particular order)
The 10 most dangerous cyber crime gangs
#10: Conti
Conti was a powerful cyber gang believed to have originated in Russia in 2020. The gang had an impressive following and was previously considered one of the largest threats to business and governments. However, in March 2022, the formidable gang posted its support of the Russian invasion of Ukraine. Days later, the gang lost most of its online support. Despite this, experts state the gang is still influential and is undergoing a ‘rebrand’.[ii]
BIGGEST KNOWN ATTACK: Costa Rica Government May 2022: the gang encrypted systems from multiple government bodies causing the country’s president to declare a national state of emergency.
CYBER ATTACK STRATEGY: Phishing emails to companies to download aggressive ransomware.
#9: REvil
The REvil model primarily uses Ransomware-as-a-Service (RaaS). Providers of RaaS rely on other hackers to distribute the ransomware and then they receive a ‘cut’ of the extortion fee. This is roughly 20%-30%. IBM Security X-Force states that REvil targets wholesale, manufacturing, and professional services industries. Further, the group focus on attacking US, UK, Australia and Canada.[iii]
BIGGEST KNOWN ATTACKS: JBS meat processing attack which affected the global beef supply chain and a $50m ransom for technical data stolen from Quanta Computer in Taiwan.
CYBER ATTACK STRATEGY: Ransomware-as-a-service (Raas)
#8: SideCopy
SideCopy was first noticed in 2020 and appears to be following in the footsteps of the now dormant Syrian Electronic Army. SideCopy is believed to be a Pakistani Threat Actor. The group has targeted both Afghan and Indian governments. The gang uses a range of attacks but focuses on targeting personnel working in government organisations to convince them to open/download malicious files. The gang also uses platforms like Facebook to connect with its victims.
BIGGEST KNOWN ATTACK: Continuous attacks on the Indian Government.
CYBER ATTACK STRATEGY: Sophisticated targeted phishing and social engineering to trick the user into downloading a malicious payload.
#7: Clop (aka Cl0p)
Like many cyber gangs, Clop was first cited in 2019 but grew in 2020 by preying on entities that deal with highly sensitive information such as the healthcare and finance industries. The group focus on a double-extortion strategy. This means after they gain access to data, they demand a ransom for the data to be decrypted, as well as demand a fee for the data to not be released publicly.
Clop has also been known to perform repeat attacks on businesses that have weak cyber security and don’t upgrade their system after an attack.
BIGGEST KNOWN ATTACK: $23m ransom on German software giant AG, one of the 10 largest software vendors in Europe.
CYBER ATTACK STRATEGY: Spear-phishing emails and exploiting old programs to discover vulnerabilities in order to upload ransomware.
#6: Cosmic Lynx
This Russian based gang targets businesses worldwide by compromising corporate email accounts (known as Business Email Compromise (BEC)) and pretending to be the CEO or a business executive. The cyber gang seems to focus on law firms, the education sector, and larger businesses. In each scenario, the gang employs a dual impersonation scheme. They then create a sophisticated story regarding a merger or business expansion. Leveraging multiple ‘credible’ accounts, the hacker then convinces the employee to give the hacker access to financial accounts and/or to download malicious files.
BIGGEST KNOWN ATTACK: The group focuses on smaller attacks and is known for its high earnings of US$1.27m per BEC attack. This is phenomenally higher than the global average of $80k per BEC attack.[iv]
CYBER ATTACK STRATEGY: BEC: the gang impersonates high-level executives to trick employees into compromising company security.
#5: DarkSide
DarkSide is a Russian-linked cyber crime gang. The group offers ‘ransomware-as-a-service, carrying out attacks on behalf of other criminals. “DarkSide’s services include providing technical support for hackers, negotiating with targets like the publishing company, processing payments, and devising tailored pressure campaigns through blackmail and other means, such as secondary hacks to crash websites.”[v]
The gang typically focuses on larger companies that are more likely to pay large ransom fees. However, they still pose a potential threat to smaller businesses that may be affiliated with the larger targets.
BEST KNOWN FOR: The US Colonial Pipeline ransom attack in May 2021.
CYBER ATTACK STRATEGY: Ransomware-as-a-service (Raas)
#4: Evil Corp
Evil Corp is a well-established cyber gang since circa 2009. The Russian-based leaders of Evil Corp allegedly live ‘millionaire’ lifestyles due to their ability to extort more than $100m from corporate victims.[vi]
The gang is not only highly organised, but continuously leverages new technology to outsmart victims and evade authorities. Over the past 12 years they have used strategies such as macro viruses, malicious photo attached to phishing emails, trojan targeting the banking industry, brute-force attacks, clickbait, and recently, leveraging Ransomware as a Service.
BEST KNOWN FOR: global expansion of it’s malware, stealing $100m across more than 40 countries.
CYBER ATTACK STRATEGY: Various, currently the most common is Ransomware-as-a-service (Raas)
#3: LockBit 3.0
The LockBit 3.0 cyber gang is effective, efficient, and highly active. The group continues to strategise to reinvent themselves, enabling them to leverage system vulnerabilities. The group also employs a ‘bounty program’ offering rewards ranging from $1,000 to $1 million to individuals who find exploits, personal data on potential victims, information on high-value targets, or ideas for improving the operation.[vii]
BEST KNOWN FOR: Stealing 78GB of data from Italy’s tax agency and demanding ransom for safe return.
CYBER ATTACK STRATEGY: Ransomware-as-a-service (RaaS)
#2: Lapsus$
Lapsus$ is a new gang in the market that focuses on data theft and extortion. As a new group, the gang is not as organised as its experienced counterparts, but leaders rose to fame for compromising Microsoft. The gang also breached Samsung and Nvidia. In March 2022, seven group leaders were arrested in London. However, the Lapsus$ attacks continued after the arrest showing that the gang is still active and growing.
BEST KNOWN FOR: Breaching Microsoft’s systems via social engineering
CYBER ATTACK STRATEGY:data theft of confidential files and extortion
#1: FIN7
Since 2012, FIN7 has been a powerhouse cyber ‘villain’. The sophisticated Russian gang operates like a business using multiple strategies to leverage stolen data. Like many of the advanced gangs, FIN7 continues to evolve its strategies to stay ahead of authorities and victims with outdated systems. The gang focuses on obtaining customer credit card records via compromising point of sale tools and e-commerce sites. They then maximise the financial return of the data by: a) asking the company for a ransom for the data back, b) threatening victims who they have the credentials of c) selling the confidential data to a third party. The group is thought to have amassed billions of dollars via its cybercrimes.
BEST KNOWN FOR: Spear phishing campaign targeting United States Securities and Exchange Commission (SEC) filings in order to steal highly confidential business information that could be monetarised.
CYBER ATTACK STRATEGY: evolving, but focused on gaining consumer credentials via vulnerable ecommerce systems.
References
You may also be interested in:
What is Cyber Security?
What are the ACSC Essential 8?
What is Ransomware?
What is Multifactor Authentication?
What are Administrative Privileges?
What is Application Hardening?
What are Man-in-the-Middle Attacks?
Check out our YouTube channel: Jam Cyber – YouTube Channel
Related Posts:
The Pros (and Cons!) of ISO 27001 for Australian SMEs
The Pros (and Cons!) of ISO 27001 for Australian SMEs Each year, the number of cyber risks faced by small
The Benefits of Restricting USB Access for Employees
The Benefits of Restricting USB Access for Employees One of the most underestimated measures for protecting an organisation’s data is
How and Why to Block HTM/HTML Attachments in Outlook 365
How and Why to Block HTM/HTML Attachments in Outlook 365 Microsoft Outlook 365 is one of the most popular business
Building a Positive Cyber Security Culture
Building a Positive Cyber Security Culture A successful cyber security culture starts at the top. We often hear the term
Recent Posts
Categories