Why did you start ransomware activity? Why not work legally as an employee or independent cybersecurity professional?

Many organizations try to deny their poor security posture, and when someone reports something to them legally, at best they pay only a minimal reward.

Do you have any motives other than money?

We are very disappointed with the level of security in different organizations, and not only with the level of security, but also with their attitude toward the information they are supposed to protect for their customers.

How do you choose your targets? Do you have red lines when selecting victims? For example, sector, country, and so on.

You are going back to a point I thought I had already made clear. We are not involved in attacking organizations. Our goal is to find vulnerabilities and then discuss with the negotiators the amount of compensation we deserve for finding those vulnerabilities 😏

The claim you are making somewhat contradicts what is happening on the ground. A few months ago you attacked a Colombian hospital, caused major chaos, and the medical care provided to patients was disrupted. How does that fit with the claim that you only find vulnerabilities and so on? Does it not bother you that these are the consequences of your activity?

The story with the hospital was different. From the moment their negotiator got involved, everything started going wrong and the situation got worse. Our partners, who took part in that incident, reported to us that the hospital had almost no cybersecurity protection at all. The hospital management chose to invest money in personal promotion instead of strengthening its defense system, and that is unfortunate. During the negotiations, we explained to the hospital that everything could be resolved within a few hours and that we would help them restore the infrastructure if we reached an agreement.

Do you feel comfortable with yourselves when you go to sleep at night? Do you not have any remorse because of what you do?

⛔ No comment

In the past, there were claims about some kind of connection between you and the Hive group. Some claimed that your websites looked similar, and so on. What is your response to this? Also, did the FBI takedown of Hive affect you in any way?

We never had any connection to Hive, so nothing changed after their takedown. We know that some people claimed our websites were similar. We simply liked their concept, so we did something similar. Why reinvent something if what you are looking for is already out there?

How does the shutdown of Tornado Cash affect your laundering processes? Has anything changed in the way ransom payments are laundered since the shutdown?

It may have been slightly problematic for some of our partners, but there are many alternatives out there that open and close every day. In short, it is not a big deal for us 💰

Do you have any connection to other attack groups? Do you sometimes operate together?

The only connection we have with other groups is that from time to time they come to consult with us on how to handle negotiations.

Do you plan to stop your activity at some point? Maybe once you reach a certain amount of money?

When the world becomes a more secure place, maybe then...

So do you have a strategic plan for the next 5 to 10 years?

We have a plan, but not for such a long period of time. Right now it is for 3 years. The world is changing quickly in this field, and we need to constantly adapt.

What is the most common attack vector through which you break into organizations? Do you always exploit vulnerabilities to gain access, or do you buy access to organizations from different sources?

Most of our partners obtain access to organizations themselves and do not buy it from third parties. Some partners even receive access for free from different sources. The most common entry vector is people who think about money instead of information security.

How much time and money do you invest in development, testing, and so on, if at all?

It is a never-ending race. Large companies invest in defense and in detecting attackers, while attackers invest efforts in remaining undetected. This investment from both sides will never stop.

How long are you inside an organization's network from the moment you get in until the ransom note is published?

It depends. I remember a case where they decided to stay silent inside the organization for more than two years ⏳

In the Conti leaks, we saw that the group was made up of different departments, such as HR, development, negotiations, and more. Do you work in a similar model, or in a more limited one?

We have people responsible for public relations, managing the Telegram channel and so on, and people who deal with human resources. There are many different initiatives in the field, but we need to choose wisely 🤓

Out of all your victims, what percentage pay the ransom?

A higher percentage than in other groups.

Are you not concerned that other groups, or even partners from within your own group, will attack your operation or report you to law enforcement agencies?

Not really. We do not have disagreements with any of the parties we work with.

Are some of the group members family people, married or with children? If so, what do you tell them about your work?

None of us has a family, and maybe that is better for everyone.

Do you have any connection to criminal elements that are not in the cyber field?

No, and we never will. These are very different worlds. Some of them are trying to enter the IT world because it is trendy, but the truth is that their mobile phone is smarter than they are 📱

Would you feel comfortable receiving services in the future from a company you previously breached?

Yes, if the company handled the incident properly. One of our rules is never to harm again a company that closed a deal with us.

Do you have any recommendations for companies regarding how to handle a ransomware incident?

If it happened to you, accept the facts as they are. Understand the mistakes made by your cybersecurity department so that you can prevent such incidents in the future. It is important for companies to remember that money can always be earned again later, but a destroyed reputation and wasted time in court over lawsuits is a different story.

A few days ago, you published a message saying that the next day you would announce a big surprise, but in practice nothing happened. Do you have anything to say about that?

Yes, sometimes things take longer than expected. We apologize if anyone waited for nothing. Soon we are launching a new channel that will allow those interested to download information easily and quickly.

Can you share a bit about the amount of ransom payments you have collected so far?

⛔ No comment