Ransomware Groups Innovate with Insider Info Ads in Ransom Notes

Ransomware groups are now incorporating advertising elements in their ransom notes to solicit insider information, according to researchers from GroupSense. This new tactic, observed in communications from groups like Sarcoma and a LockBit impersonator known as DoNex, involves threatening potential victims while also offering rewards for insider tips. Notes invite individuals to expose their company's vulnerabilities, along with instructions to engage through a secure messaging platform to maintain privacy. Kurtis Minder, CEO of GroupSense, suggests this strategy may enhance the visibility and effectiveness of ransom demands, indicating a possible trend that other groups might adopt.

Opens on Dark Reading