Security researchers have detailed the fallout between cyber criminals following the Colonial Pipeline and Kaseya attacks. The consequences of these debacles has resulted in the formation of a new ransomware gang called Groove.
Researchers said the catalyst for this was when popular cyber crime forums banned ransomware actors from advertising following the Colonial Pipeline attack. This made it harder for ransomware-as-a-service (RaaS) groups to establish credibility and maintain their current top tier position in the underground.
After a tempestuous shutdown of Babuk and the aftermath following the Colonial Pipeline and Kaseya attacks, some of the ransomware-affiliated cybercriminals have found a home in a forum known as RAMP, according to a blog post by researchers at McAfee.
The cyber crime forum’s name supposedly stands for “Ransom Anon Mark[et] Place”. RAMP was created in July 2021 by a threat actor TetyaSluha, who later changed their name to Orange. The forum provides coordination, communication, and organizational support for the top cyber extortionists.
“This actor claimed the forum would specifically cater to other ransomware-related threat actors after they were ousted from major cybercrime forums for being too toxic, following the high-profile ransomware attacks against the Colonial Pipeline and Washington D.C.’s Metropolitan Police Department in the spring of 2021,” said researchers.
RELATED RESOURCE
The state of ransomware in retail 2021
Insights into the current state of ransomware in the retail sector
Orange is thought to be a member of a new ransomware gang called Groove, according to research published by security firm Advanced Intel.
Researchers said Groove is a novel ransomware group that became especially active in August and September 2021. Groove allegedly employs former Babuk developers and possesses advanced tactics and tools.
“For instance, on September 7, 2021, the same day as the publication of the “Ransomware Thoughts” Groove released leaks of Fortinet VPN SSL credentials via their leak website. The list contains 799 directories and 86,941 purportedly compromised VPN connections. The reason behind the leak is unclear,” said researchers.
Researchers at Advanced Intel said as Groove and Babuk both continue to exist, “we are likely to see more drama coming our way.”
“This state of affairs demonstrates a complex ransomware ecosystem where new groups emerge as a result of the competition within larger gangs that fall apart and due to inner conflicts, while older groups attempt to rebrand in order to institutionalize the paradigms which they considered operationally existential,” they added.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
