Hackers Unite: Ransomware Group Adopts Espionage Tactics in New Threat
Ars Technica
|
Contributed by: Drex DeFord
Summary
Researchers from Symantec have identified a partnership between financially motivated hackers and espionage groups, specifically noting the RA World ransomware group's use of a toolset previously linked to Chinese espionage operations. The toolset is a variant of the custom backdoor PlugX, associated with various Chinese threat actors, and was involved in espionage attacks targeting government entities in Southeast Asia and southeastern Europe from August 2024 to January 2025. This unusual crossover of tactics—typically not found in Chinese cyber actors' financially driven operations—raises questions about the hackers' motivations, prompting speculation about potential connections to known groups like Bronze Starlight and whether these ransomware deployments serve as a cover for espionage activities.
