CryptNet: Ransomware-as-a-Service with obfuscation
The ransomware group CryptNet has been active since April 2023. Their malware, which is also offered as ransomware-as-a-service on the dark web, is simple but arguably effective and well-disguised against detections. An analyst from the Zscaler ThreatLabz team. The new group sells their ransomware-as-a-service in underground forums and recruits partners for their criminal activities there. The analysts now examined the modus operandi of the current campaign, which according to the threat actors steals data from affected companies before decryption in order to reinforce their ransom demands by publishing them on a data leak website. Ransomware including obfuscation The code of the…