A group of extortionists named “Midnight” has been using data breaches and ransomware incidents to threaten U.S. companies. The group demands payment, threatening to sell or publish allegedly stolen data if the victims do not comply with their demands. In some cases, the group also threatens victims with a distributed denial-of-service (DDoS) attack.
Since at least March 16, Midnight has been targeting U.S. companies, claiming to have stolen hundreds of gigabytes of important data. The group has also impersonated some ransomware and data extortion gangs in emails, including the Silent Ransom Group (SRG) and the Surtr ransomware group.
The fake emails are part of a larger trend, which has been observed by managed detection and response division at the Kroll corporate investigation and risk consulting firm since early November 2019. The attackers use the names of better-known cybercriminals in an attempt to intimidate and give legitimacy to their threat.
Kroll reported that, starting March 23, organizations began filing an increased number of reports for emails received under the Silent Ransom Group name. The company stated that this is a new wave of fake extortion attempts, and the trend is expected to continue indefinitely due to its cost-effectiveness.
Arete, another incident response company, confirmed Kroll’s observations about Midnight Group’s fraudulent emails impersonating Surtr and SRG. However, the company noted that Midnight targeted organizations that had previously been victims of a ransomware attack.
According to Arete, at least 15 of their current and previous clients received fake threats from the Midnight Group. It is unclear how victims are selected, but it is possible that the group obtains information from publicly available sources, such as data leak sites, social media, news reports, or company disclosures.
The sources for this piece include an article in BleepingComputer.