Turf War Erupts Among Cybercriminal Ransomware Groups

The recent cyberattacks targeting UK retailers such as Marks and Spencer, Harrods, and the Co-Op are part of a broader conflict between notorious ransomware groups. DragonForce, a cybercriminal gang primarily based in Russia, has clashed with one of its main competitors, RansomHub, in what experts describe as a turf war within the ransomware-as-a-service (RaaS) industry.

This rivalry has escalated after DragonForce rebranded itself as a ‘cartel’ in March, expanding its services and attracting more affiliate partners. In response, RansomHub’s website was reportedly taken over by hostile actors aligned with DragonForce, with signs indicating a hostile takeover.

The hostility intensified when a RansomHub member retaliated by defacing DragonForce’s website, labeling them as ‘traitors.’ The discord stems from strategic moves within the dark web marketplaces where these groups sell their ransomware tools and infrastructure.

Cybersecurity experts warn that this infighting could increase the danger for companies. Victims may face extortion from multiple groups, heightening the financial and operational risks for affected organizations. Toby Lewis of Darktrace emphasized that in the hacking realm, there is often “no honor among thieves,” as cybercriminals seek to outdo each other at the expense of their targets.

This escalation among ransomware groups not only threatens individual companies but also signifies a more volatile and unpredictable cybercrime landscape, potentially leading to more frequent and severe attacks in the future.

Arstechnica