Recent operational successes by UK law enforcement have exposed sophisticated domestic carding networks and the growing threat of youth-targeted money muling syndicates.
In June 2026, a major cross-border investigation concluded with the sentencing of a serial fraudster who targeted small businesses, including veterinary clinics and hotels, across 22 different counties in England and Wales.
The individual executed over 64 frauds and two thefts, accumulating losses totalling £462,000. The threat actor utilised stolen payment card details to buy goods and explicitly manipulating transaction values to inflate the amounts charged before requesting rapid refunds directly into bank accounts under his control.
Following his arrest, investigators seized an array of high-value items, including designer clothing and mobile devices. Financial telemetry revealed the illicit proceeds were being spent on luxury goods, gambling, hotels, and vehicle hire. Crucially, investigators uncovered an expansive network of money mule accounts specifically set up to layer and obfuscate the stolen funds.
Separately, regional policing teams executed a series of targeted strikes aimed directly at these types of laundering networks, resulting in the arrest of three men (aged 18, 22, and 26) on suspicion of conspiracy to defraud and for money laundering, along with the seizure of £14,000 in cash.
Law enforcement issued a stark warning following the raids, noting an aggressive operational shift where organised crime groups (OCGs) are actively leveraging social media platforms like Snapchat and Instagram, alongside popular online gaming ecosystems, to systematically recruit young teenagers into mule networks.
Analyst Comment
This twin set of enforcement actions illustrates the complete lifecycle of a modern domestic fraud operation. The acquisition and monetisation of stolen data (also known as Carding), followed by the immediate mobilisation of a decentralised laundering infrastructure (also known as Money Muling). The carding scheme highlighted in the 22-county campaign demonstrates that threat actors are moving away from simple e-commerce checkout abuse and are instead focusing on the operational blind spots of small, brick-and-mortar or service-oriented businesses.
By manipulating transaction values and exploiting refund protocols, the fraudster successfully weaponised point-of-sale or card-not-present (CNP) systems to manufacture clean cash flows. However, the scale of this carding activity requires a highly liquid laundering pipeline to survive traditional banking fraud detection. This is where the recruitment of money mules becomes a vital asset for OCGs.
The pivot toward social media, such as Snapchat and Instagram as well as online gaming platforms to recruit teenage money mules is a calculated tactic by syndicates.
Young demographics are highly susceptible to social media advertisements that mask the severe criminal realities of money laundering, framing it instead as a quick, victimless side-hustle. Many young people do not understand that allowing someone to route funds through their personal bank account is a serious criminal offense that can result in first-party fraud markers (such as a CIFAS marker), effectively destroying their financial future before it begins.
Further, a widespread lack of proactive parental supervision, combined with missing or unconfigured digital parental controls on mobile devices and gaming accounts, allows recruiters to directly message minors entirely undetected.
Defensive Takeaways
Harden Refund Protocols for Small Businesses: Businesses in vulnerable service sectors must enforce strict multi-factor verification for all card-not-present transactions and mandate that any processed refunds should only return to the exact card used for the initial purchase.
Proactive Parental Monitoring & Platform Safety: Parents must actively utilise device level and application-specific parental controls on social media and gaming networks. Conversations regarding digital safety must expand past cyberbullying to include the tactical red flags of financial grooming and "easy cash" offers.
Targeted School and Community Education: Educational institutions and financial bodies should collaborate more often on mandatory cyber-hygiene campaigns that explicitly outline the legal penalties of money muling, illustrating how a compromised bank account can permanently restrict access to student loans, mobile contracts, and future employment.
The modern cyber threat landscape has seen a fundamental shift in how threat actors manage and deploy their infrastructure. Advanced persistent threats (APTs) have almost completely moved away from static command-and-control (C2) servers, opting instead to build complex, multi-layered botnets known as Operational Relay Box (ORB) networks.
Project ORBITAL (which stands for Operational Relay Box Intelligence, Tracking, & Analysis Lexicon) was established as a centralised intelligence matrix to track, analyse, and ultimately help defenders disrupt this highly evasive infrastructure.
To construct these networks, adversaries systematically compromise unpatched, end-of-life devices. By targeting legacy, unpatched Small Office/Home Office (SOHO) router and Internet-of-Things (IoT) devices attackers can create a sprawling, decentralised mesh of proxy nodes. By routing their operations through layers of compromised devices, adversaries mask their true origins, making malicious activity blend seamlessly with legitimate regional traffic.
Blogs by my colleagues at Team Cymru as well as Google offer detailed explanations as to why and how these ORBs have grown over many years and continue to expand.
Project Background
Project ORBITAL represents a centralised Open Source Intelligence (OSINT) collection driven by public reporting from advanced research teams across the cybersecurity and technology sectors. This initiative aggregates telemetry and findings from top-tier vendors including Cisco Talos, CrowdStrike, Google, GreyNoise Labs, Lumen Black Lotus Labs, Microsoft, SecurityScorecard, Sekoia, SentinelLabs, Sygnia, and Team Cymru. Furthermore, it incorporates critical alerts and intelligence shared publicly by United States government agencies, specifically the Federal Bureau of Investigation (FBI), the Cyber National Mission Force (CNMF), and the National Security Agency (NSA).
This repository builds on the methodology of my previous OSINT tracking initiatives. It is heavily inspired by the structure and community success of my earlier matrix projects, specifically the Ransomware Tool Matrix (RTM) (here), the Ransomware Vulnerability Matrix (RVM) (here), and the Russian APT Tool Matrix (RUTM) (here). By applying a similar, structured approach to mapping Operational Relay Box (ORB) networks, this project aims to provide defenders with a clear, actionable lexicon for hunting and tracking evasive edge-device botnets.
Graph Visualisation
Once Project ORBITAL was initially assembled, it was then possible to use a GitHub Action automation with NetworkX and PyVis to create a Graph Visualisation using the data collected. Once in this view, some interesting patterns could be observed.
Analysis of the extracted data uncovered that ASUS devices were the most targeted out of all of the targeted devices by ORBs from the public reports.
Another interesting point the graph highlighted is that the LapDogs ORB network had the highest number of reported targeted devices.
In most reported scenarios, a singular threat group used a dedicated ORB network. However, from extracting the details from the Google and SentinelLabs reports, an adversary like APT15, reportedly leverages both SPACEHOP and PurpleHaze ORB networks, alongside two other separate adversaries UNC2630 and UNC5174.
The overlap in ORB usage suggests these APTs aren't all building their own botnets from scratch. These overlaps likely indicate there are provisioning teams, such as specialised contractors, like Beijing Integrity Tech, who build and maintain these ORB networks and then lease access to the broader Chinese intelligence community in the Ministry of State Security (MSS) and People’s Liberation Army (PLA).
Panda-monium
Below is the list of well-known China-nexus APTs listed using CrowdStrike’s naming scheme and their Google or Microsoft aliases that are all mentioned in Project ORBITAL.
CAULDRON PANDA (aka UNC3886)
ETHEREAL PANDA (aka Flax Typhoon)
JUDGMENT PANDA (APT31, Violet Typhoon)
KEYHOLE PANDA (aka UNC2630, APT5)
MURKY PANDA (aka Silk Typhoon)
VANGUARD PANDA (aka Volt Typhoon)
VIXEN PANDA (aka APT15, Nylon Typhoon)
The most notable aspect about this list is that it contains APTs with wildly different mandates. VANGUARD PANDA (Volt Typhoon) is famous for pre-positioning within critical infrastructure with the potential disruptive attacks, while KEYHOLE PANDA (APT5) and JUDGMENT PANDA (APT31) are long-running cyber-espionage and IP theft operators. The fact that both the saboteurs and the spies have all adopted ORB networks goes to show that this tactic is not niche but instead is the baseline standard for Chinese APT operational security (OPSEC).
How to Access
You can find Project ORBITAL on my GitHub repository below:
This blog is a focused update on the latest updates to the Ransomware Tool Matrix (RTM) and the Ransomware Vulnerability Matrix (RVM) covering three groups that I have published profiles for to help defenders home in on the threats most relevant to them: TheGentlemen, DragonForce, and WarLock.
Rather than write another broad ecosystem summary, the goal of this post is to introduce these profiles, briefly explain why each group matters right now, and give readers direct links to them so defenders can pivot straight into hunting, detection engineering, and patch prioritisation.
For anyone new to the projects, please read the descriptions on GitHub or feel free to watch my talk explaining the project at BSides London.
Why these three groups?
Each of the three groups added in this update represents a different slice of the current ransomware ecosystem:
TheGentlemen
TheGentlemen is a newer operation that has matured quickly, with a large and varied toolkit that reflects how cross-pollinated the affiliate ecosystem has become. The recent internal chat leak gave researchers a rare look into their tradecraft, and the profiles capture both the tooling and the exploited CVEs that have been observed across multiple intrusions. TheGentlemen’s RTM profile is here and RVM profile is here.
DragonForce
DragonForce has continued to escalate throughout 2025 and into 2026, branching into MSP-focused attacks and standing up its own "cartel" model that other affiliates can plug into. Its exploitation of edge devices (Ivanti, Fortinet, SonicWall) and SimpleHelp RMM make it a high-priority threat for any organisation using such systems. DragonForce’s RTM profile is here and RVM profile is here.
WarLock
WarLock jumped onto everyone's radar after the ToolShell SharePoint zero-day exploitation campaign, and has since been linked to a string of edge-application exploits including SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack. It is a strong example of a likely China-based operator that lives on zero-day exploitation of internet-facing software. WarLock’s RTM profile is here and RVM profile is here.
Observations and Trends
A few themes are worth flagging across all three profiles:
BYOVD is now standard, not novel. All three groups have been observed bringing vulnerable drivers to disable or blind EDR. TheGentlemen with ThrottleStop driver, DragonForce with the TrueSight and Hangzhou Shunwang drivers, and WarLock with Antiy, NsecSoft, Rising, and VMTools drivers. If your detection stack is not yet hunting on or blocking suspicious driver loads and known-bad driver hashes, that is a high-priority gap to close.
Network edge devices and other internet-facing systems remain the front door to victim networks for these groups. Fortinet, Ivanti, SonicWall, SimpleHelp, Microsoft SharePoint, SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack all appear across these three profiles. Patch prioritisation that focuses on internet-exposed appliances and admin tooling continues to give defenders a valuable return on effort.
Legitimate tooling continues to blur the line. Velociraptor, Cloudflared, VSCode Tunnels, AnyDesk, MeshCentral, FreeRDP, PuTTY, OpenSSH, and a long list of legitimate cloud services are all being repurposed for ransomware operations. Defender should use these lists to begin baselining what should exist in their environment and start alerting on the rest.
Conclusion
My recommendation for defenders remains the same as in previous updates: take the tools and CVEs from the RTM and RVM profiles and start threat hunting for their presence, writing detection rules to alert on certain behaviours, and blocking what is not expected or permitted in your environment. These three new profiles should make that easier to scope by group when you need to brief leadership, prioritise a hunt, or map your exposure to a specific campaign.
Here's a few sites that can help with turning the threat intel in these new profiles into detections:
As always, feedback and pull requests are very welcome on both repos. Thanks to everyone who has contributed reports, corrections, and ideas. These projects only stay useful because the community keeps feeding them one way or another.
The Ransomware Tool Matrix continues to be a useful passion project that I am happy to continue maintaining. One piece of common feedback I've received for the Ransomware Tool Matrix was that individuals would like to contribute their observations to it, but do not have public links they can cite (such as a formal blog post on a company website). Therefore, I came up with a plan to make a reporting template to help with this.
What are Community Reports?
Individuals can now share what tools they have seen various ransomware groups, affiliates, or initial access brokers (IABs) use via the new Community Report Template. The level of detail provided is the contributor's choice. The more verifiable information shared, the increased level of reliability and credibility.
You can view the current list of Community Reports on GitHub here.
Why the need for Community Reports?
Most of the sources of CTI about ransomware TTPs comes from open source reports by organisations such as the US Cybersecurity and Infrastructure Security Agency (CISA), The DFIR Report, and other cybersecurity vendors. From the beginning it was important to recognise the importance of the having public citations by reputable organisations to maintain the reliability and credibility of the resource overall. Consumers of the Ransomware Tool Matrix should feel confident that the information provided is of high standard and legitimate.
The problem was, however, that members of the cybersecurity community who may work with victims of ransomware attacks also have information about what tools which ransomware group uses.
The sources of this information could come from various sources, such as from Digital Forensics and Incident Response (DFIR) service providers, Managed Security Service Providers (MSSPs), Endpoint Detection and Response (EDR) vendors, or security researchers who manage to obtain threat intelligence about ransomware groups via various other means, such as infiltrating cybercrime forums or open directory hunting.
These sources of information did not currently have a way to contribute to the Ransomware Tool Matrix due to the missing factor of a publicly citable blog.
How do Community Reports work?
Members of the Community with information and tools used by ransomware groups can now share their observations via a structured report template shown below.
Whether to include all the details here is up to the contributor, but this type of reporting system is an option for community members to share their findings with the rest of the community who are interested in this information.
Anyone who wants to submit a Community Report can copy the code, edit in their findings, and submit a pull request to the GitHub repository. Alternatively, they can fork the project and then I can merge their commits to the main branch. More details about how to creating a pull request from a fork can be found in the GitHub's Docs here.
Conclusion
One of the problems of cybersecurity vendor blogs is that a lot of them are marketing material and therefore, details about every ransomware incident a company worked on is not great marketing. However, as CTI analysts, incident responders, threat hunters, and detection engineers, these details are crucial for our day-to-day lives. Hence why the Community Report system was one of the most common pieces of feedback I received and why I created it.
I look forward to the contributions from the community to this new reporting system and hope it helps many more who are keen to see and read about what the latest tools are that the ransomware cybercriminals are using.
This blog is a summary and analysis of recent additions to
the Ransomware
Tool Matrix (RTM) as well as the Ransomware
Vulnerability Matrix (RVM). Feedback from the infosec community about these projects has
been overwhelmingly positive and many researchers have contacted me to tell me
how helpful they have found these to be. It makes me happy to hear how doing something in my spare
time can help stop ransomware attacks and cybercriminals from exploiting our
society’s systems. And it is for that reason, I shall continue to maintain
these projects as long as ransomware is still around. For anyone new to these projects, please read the
descriptions on GitHub or feel free to watch my talk explaining the project at BSides London.
Background on the current ransomware ecosystem as of May
2025
Following the impact of Operation Cronos against LockBit and
the exit scam by ALPHV/BlackCat, the ransomware ecosystem has been even more unstable
than usual. The exit scams and law enforcement infiltration operations
have created a zero trust environment for the cybercriminals participating in
the ransomware economy. The days of affiliates putting their faith in one RaaS
platform seem to be long gone and many are experimenting and going from one
RaaS to the next.
Sources of Threat Intelligence for the RTM
The RTM was updated with OSINT reports shared by
cybersecurity researchers at various private service providers or vendors. The
thing to remember about these reports is that the tool usage is going to be
slightly outdated due to the time it takes incident response teams to wrap up
an investigation, compile findings, and publish a report.
From the reports, threat groups such as Qilin, BlackSuit,
RansomEXX, Medusa, BianLian, Hunters International and PLAY have been active
for over one year or for multiple years. These are established groups. Since
RansomHub and LockBit have shut down, it is more likely than not that the
affiliates have already shifted to one of the other RaaS platforms, like Qilin,
among others.
There has also been a number of ransomware operations suspected
to be linked to Chinese cyber-espionage groups, such as RA World (for using PlugX),
NailaoLocker (for using ShadowPad and PlugX), and CrazyHunter (for its focus on
Taiwan).
Threat groups such as IMN Crew, QWCrypt (linked to RedCurl),
NightSpire, SuperBlack, and Helldown are all rising threat groups that have
more recently begun their ransomware campaigns.
These factors have led to seeing a large variety of tool
usage in ransomware operations being observed across the landscape. The
reliance on tools from sites like GitHub and other free software sites, however,
continues to remain a constant theme among all of these ransomware operations.
List of sources used for the May 2025 major update to the
RTM:
EDRSandBlast and WKTools are relatively new tools that are
being used by multiple groups to deactivate and overcome EDR tools that many victims
will have on their networks to prevent ransomware attacks.
Typical ransomware tools, such as PsExec, Mimikatz, and
Rclone remain effective and still used by multiple ransomware gangs for the
foreseeable future.
Tool
Type
Groups Using It
WinSCP
Exfiltration
NightSpire
Hunters International
Mimikatz
Credential Theft
RansomHub
Qilin
Helldown
Impacket
Offensive Security Tool
RansomHub
RA World
NailaoLocker
Rclone
Exfiltration
RansomHub
Hunters International Medusa
NetScan
Discovery
RansomHub
Medusa
WKTools
Discovery
RansomHub
BianLian
PLAY
Advanced IP Scanner
Discovery
Hunters International BianLian
Advanced Port Scanner
Discovery
Hunters International Helldown
AnyDesk
RMM Tool
Medusa
BianLian
EDRSandBlast
Defense Evasion
Medusa
Qilin
New Tools Added to the RTM
The most notable new tools added to RTM include several defense
evasion tools for deactivating EDRs, discovery for sensitive files, and tunnelling
tools to conceal adversary network connections.
Tool
Type
Groups Usage
Bublup
Exfiltration
BlackSuit
WKTools
Discovery
BianLian, PLAY
AmmyyAdmin
RMM Tool
BianLian
CQHashDump
Credential Theft
NailaoLocker
Throttle Stop Driver
Defense Evasion
Medusa
KillAV
Defense Evasion
Medusa
BadRentdrv2
Defense Evasion
RansomHub
Toshiba Power Driver (BYOVD)
Defense Evasion
Qilin
ZammoCide
Defense Evasion
CrazyHunter
FRP
Networking
Medusa
Stowaway
Networking
RansomHub
Navicat
Discovery
Medusa
Everything.exe
Discovery
NighSpire
RoboCopy
Discovery
Medusa
NPS
Networking
RA World
SharpGPOAbuse
Offensive Security Tool
CrazyHunter
Attrib
LOLBAS
BlackSuit
Curl
LOLBAS
QWCrypt (RedCurl)
PCA Utility (pcalua)
LOLBAS
QWCrypt (RedCurl)
Exploits used by Ransomware Gangs added to the RVM
As is now usual, multiple ransomware groups have been targeting
Fortinet networking devices for initial access into to victim environments.
Multiple ransomware groups continue to exploit the Windows Common
Log File System (CLFS) for local privilege escalation to run hacking tools and
steal credentials.
Other exploits involve targeting edge devices, such as Check
Point VPNs or PAN Firewalls, or exposed servers, such as Atlassian Confluence Data
Center Servers.
The targeting of Veeam backup software should come as no
surprise as preventing backups or stealing sensitive files, such as Active
Directory backups, are key objectives of ransomware gangs to complete their
mission.
My recommendation for defenders who continue the fight against ransomware is to take some of the findings from this report and begin threat hunting, detection rule writing, and start blocking some of these tools not present in the environments you are protecting.
Here are a few sites to help you get started with:
One of the challenges with investigating cybercrime is the
infrastructure the adversaries leverage to conduct attacks. Cybercriminal
infrastructure has evolved drastically over the last 25 years, which now involves
hijacking web services, content distribution networks (CDNs), residential
proxies, fast flux DNS, domain generation algorithms (DGAs), botnets of IoT
devices, the Tor network, and all sorts of nested services.
This blog shall investigate a small UK-based hosting provider
known as BitLaunch as an example of how challenging it can be to tackle
cybercriminal infrastructure. Research into this hosting provider revealed that
they appear to have a multi-year history of cybercriminals using BitLaunch to
host command-and-control (C2) servers via their Anonymous
VPS service.
The year-on-year growing number of CobaltStrike C2 servers
hosted on BitLaunch’s services could be an indicator of tacit collusion with
cybercriminals through the facilitation of cheap and quick to procurement of
VPSs that end up being used to launch ransomware attacks on all sorts of
victims, including hospitals, schools, governments, companies, and charities.
The concept of aiding and abetting criminal activity in law is
essentially when an individual or an organisation intentionally assists,
facilitates, or encourages a crime. In this case, it would be aiding and
abetting the creation of cybercriminal infrastructure. If a hosting provider
ignores clear red flags (e.g., cryptocurrency payments from known illicit
sources or use of servers for illegal activities), they might still be held criminally
liable under wilful blindness under certain laws.
In the past, authorities have taken down bulletproof hosting
(BPH) providers that knowingly support cybercrime, such as CyberBunker and
LolekHost. In February 2025, the UK government also sanctioned
a Russia-based BPH known as ZSERVERS (aka XHOST) for facilitating LockBit
attacks.
Update: This blog was updated with a statement from BitLaunch (see the end of this blog).
Who is BitLaunch aka BL Networks aka BLNWX?
Active since at least 2017, BitLaunch (also known as BL
Networks or BLNWX) is a virtual private server (VPS) reseller whose autonomous
system number (ASN) is AS399629.
Up to 48 IPv4 networks belong to BitLaunch
which are used to "instantly launch a Linux or Windows VPS” where
customers can “pay hourly with Bitcoin, Litecoin, and Ethereum, with no firm
commitments." BitLaunch also supports their customers via a command-line (CLI)
tool and a Python
library. BitLaunch has another name, however, in their legal terms and conditions
they go by Liber Systems and have their own separate website.
Why focus on BitLaunch?
BitLaunch is quite interesting as they present themselves as
a UK-based company run by two local UK businessmen. Their “anonymous Bitcoin
VPS” service is regularly abused for all sorts of cybercriminal activities. What
triggered this research was the fact that their nickname “BLNWX” was regularly
reappearing in cyber threat intelligence (CTI) vendor reports on ransomware and
other cybercriminal campaigns. It is also worth highlighting that while BitLaunch own their
own IP networks, they are a VPS reseller as well who works with DigitalOcean,
Linode, and Vultr, as shown from their website below.
One website that reviews so-called “offshore services” (offshore[.]cat) has listed BitLaunch as being a “verified” offshore hoster that accepts cryptocurrency, only requires email request confirmation to open an account, and is described as allowing anyone to “create VPSs in seconds, using crypto” making them an attractive hoster for cybercriminals. Their service paired with their CLI tools and Python libraries makes it super easy to stand up C2 servers rapidly.
Command and Control (C2) infrastructure on BLNWX
Significant numbers of CobaltStrike C2s among other hacking
tools and malware families have been discovered on BitLaunch. I would like to
thank the owner of the C2IntelFeedsBot (@drb_ra)
account on X/Twitter who assisted with this research by providing their feed of
C2 servers discovered on BitLaunch.
The image below shows a sampling of the known C2 servers
hosted with BitLaunch between 2021 and 2025. The most notable part of this
diagram is the number of CobaltStrike C2 servers in particular. Cobalt Strike
is a well-known C2 framework used by organised cybercriminal groups to launch
ransomware attacks. It is also favoured by state-sponsored threat groups as
well.
Over the last few years, several dozen C2 servers have been
identified by the C2IntelFeedsBot and each
year, the number of C2s has continued to grow as more cybercriminals identify
BitLaunch as a preferable service to support their ransomware campaigns.
The image below displays the totals calculated between “2021-06-26
12:33:41" and "2025-02-05 18:46:10." It is not a complete
picture by any means, but this independently verifiable data gives a decent
idea of the rate at which BitLaunch is being used by cybercriminals, with each
year since 2022 has trended upwards.
One of the interesting things about CobaltStrike is that it
is a commercial offensive security tool (OST). It is issued to legitimate
customers through licenses, which have a unique watermark. While there have
been several cracked versions of CobaltStrike over the years, it is possible to
track certain groups through their usage of the same CobaltStrike versions.
The image below shows the distribution of the CobaltStrike
watermarks gathered from BitLaunch. Notably, “0” is the most common. This is
often the case when analysing CobaltStrike watermarks as this signifies it is
the cracked version.
OSINT collection and analysis of the CobaltStrike watermarks
revealed potential connections to several well-known cybercriminal groups using
BitLaunch who have a history of conducting ransomware attacks:
"426352781” – This watermark is used by ShadowSyndicate,
a ransomware affiliate group tracked by Group-IB which is connected to multiple
Ransomware-as-a-Serivce (Raas) platforms. This watermark is also historically associated
with CobaltStrike Beacons dropped
by the Qakbot malware botnet.
“1580103824” – This watermark was linked to ShadowSyndicate
as well, alongside the Cleo
exploitation campaign attributed CL0P ransomware. A threat group tracked by
CERT-UA as UAC-0056 has also been observed
using this watermark too.
”987654321” – This watermark has been associated
with the IcedID malware botnet and the Dagon Locker ransomware gang previously.
”1359593325” – This watermark has been used by CobaltStrike
Beacons in campaigns attributed
to the Russian Foreign Intelligence Service (SVR)
“391144938” and “305419896” – These watermarks have been
attributed to campaigns by multiple Chinese cyber-espionage campaigns tracked
by SentinelOne,
Recorded
Future, Zscaler,
and Cisco
Talos.
C2s on BLNWX attributed to Ransomware Gangs by CTI vendors
There are a number of CTI reports over the last couple years
that directly reference BitLaunch Networks (BLNWX) IP addresses as Indicators
of Compromise (IOCs) as part of high-profile ransomware campaigns.
This includes attribution
to the Yanluowang ransomware attack against Cisco, a C2 linked
to the JavaScript more_eggs backdoor used by FIN6 (who is connected to
ransomware campaigns), a dozen IPs attributed to Rhysida
ransomware attacks, and a Rhysida and Interlock ransomware precursor
campaign tracked as TAG-124,
as well as the PaperCut
exploitation campaign which involved
both LockBit and CL0P.
Additional notable CTI alerts that called out BLNWX include
a report on Latrodectus,
a ransomware precursor campaign, by Proofpoint; Okta-themed phishing campaigns
attributed to Scattered
Spider, who has carried out ALPHV/BlackCat and RansomHub attacks, by
Intel471; infrastructure used to enable
the BlackBasta ransomware gang by QuadrantSec, as well as C2 servers of the IcedID
malware botnet that has been used by ransomware gangs for initial access.
Assessment of BitLaunch
As of February 2025, BitLaunch's parent firm Liber Systems Limited is run by two UK-based directors according to UK Companies House. While they are profiting off this Anonymous VPS service they are not taking the appropriate steps to prevent their service from being used by
ransomware and malware gangs. Organised cybercrime groups have evidently found and recognised this about BitLaunch and are leveraging the cheap, crypto-accepting service
that doesn’t ask too many questions.
To be fair to BitLaunch, they appear to be responsive to
takedowns and are noted on Offshore[.]cat as enforcing DMCA requests. The crux
of the issue though is that the cybercriminals can use their service to rapidly
spin up instances for C2 for a few hours and chuck it away again. This means there often no need to submit a takedown as the cybercriminals has already abandoned the C2 and can spin up another one. Therefore,
the cybercriminals can continually leverage BitLaunch without interference.
As a security researcher, and not a police officer, I cannot comment on how cooperative BitLaunch have been with the police and it is probably not something BitLaunch would want to advertise to their customers anyway based on who some of their customers are.
For BitLaunch’s two directors, this works out nicely for them. They
can take the cybercriminals money via cryptocurrency and also appear to be
ethical and compliant by assisting with law enforcement takedown requests. Currently, they appear to be helping both the criminals and the police, and have been getting away with it for years.
On BitLaunch’s front page advertisement they highlight as
the main focus as being able to pay hourly for the use VPS and that customers
can pay in “anonymous cryptocurrency.” It is in my opinion, and that of other
cybersecurity researchers I have spoken to about this (including red teamers and penetration testers), that
this service is perfect for C2 servers and almost nothing else legitimate.
The Broader Issue with Anonymous VPSs
In BitLaunch’s blogs, they say they believe the internet should be "open, free, and devoid of interference by any single government or authority" adding that accept cryptocurrency because "citizens of some countries do not have bank accounts and can use Bitcoin
instead" because the local banks have control over who their citizens can send money to.
Their blogs also state that they believe internet users should be allowed to
run their own virtual private networks (VPNs) for anti-surveillance and privacy
reasons. They also provide lots of guides on how to configure private VPNs for this purpose. While this is a legitimate service that is useful for some people in specific situations, having it be abused by ransomware gangs is a situation that needs to be changed.
This issue of selling anonymous VPSs is not specific to this one company. BitLaunch is
obviously a small company and proactively combating cybercriminals from
registering VPSs on their service is an expensive and multi-pronged challenge
for any hoster, which includes preventing abuse while preserving the privacy of
their customers.
Hosters such as BitLaunch could use services such as Shodan, Abuse.ch,
GreyNoise, OTX Alienvault, and AbuseIPDB to check if their IP addresses are
being abused. One interesting example of a hoster trying to tackle this issue is how PQ Hosting (aka Stark Industries Solutions) announced publicly on their blog that they have partnered with Team Cymru, a netflow security intelligence firm. Alternatively, hosters could use a blockchain analytics platform like Chainalysis, TRM Labs, or Arkham Intelligence, to trace cryptocurrency payments from known illicit wallet clusters.
There will, however, always be some threats that slip through the net. It is undoubtedly a difficult challenge for small hosters
who do not have funds to sacrifice on network observability tools or CTI
platforms. Even some of the world’s largest hosters, such as Cloudflare
struggle with this as well and end up having their services abused for cybercrime operations.
The anonymous VPS problem could be
compared to issues in other industries such as stolen funds being used to buy gift cards or game keys that are then resold for money laundering. Another platform often
abused for a variety of scams and phishing campaigns is Gmail. Is Google being
wilfully negligent to cybercrime happening on their platform? That’s a question
I shall leave for readers to decide on their own.
Overall, this type of issue is analogous to a hotel offering rooms for the night and organized criminals renting them to commit various types of crimes inside them. Ultimately, the criminals are the ones breaking the law, not the hotel, but if the hotel is being constantly made aware of these activities by bystanders and law enforcement, it is their duty to shut that activity down, to the best of their abilities.
What the UK Could Do About It
In this scenario around BitLaunch, there are three potential ways the UK could help stop these small hosters being taken advantage of by
cybercriminal operations.
Firstly, the cybersecurity and hosting industry could launch an initiative through institutions, such as the British Computer Society (BCS) or something, that would work to convince hosting providers that the
hassle being investigated by law enforcement agencies, sanctions, or the chance
of being arrested is not worth the funds generated from selling C2 servers to cybercriminals.
Secondly, as BitLaunch (or Liber Systems) is registered here, the UK Government Department for Science, Innovation, and Technology (DSIT) could work with them and other small hosters to regulate the industry and
provide support to these businesses to warn them of the dangers of offering
unregulated VPS services and inform them how they contribute to the
damage that ransomware attacks are having on the UK and elsewhere.
Third, providing free network observability services to
hosters could also help them proactively shutdown C2 servers before they are
weaponised against victims. All UK hosters can sign-up to the free UK
government-provided service called MyNCSC, offered by the UK
NCSC, which is part of GCHQ. Hosters will then get alerts when MyNCSC detects
which IPs are flagged for hosting C2 servers (such as CobaltStrike).
As the UK government’s mandate
is to “make the UK the safest place in the world to live and work online” then
tackling the issue with these UK-based hosters supporting ransomware
should also be one of those priorities.
Indicators of Compromise
Historic Malicious BLNWX IP addresses are available below:
Statement from BitLaunch following the publication of this blog:
"BitLaunch appreciates the conversation surrounding the misuse of VPS hosting services. It is an important topic, and there is always room for improvement and reflection. That said, we believe the article contains several key inaccuracies and misleading implications. We take the prevention of abuse on our platform very seriously, and we would like to offer the following context:
We reject the notion that BitLaunch may be in "tacit collusion with cybercriminals" due to the year-on-year growth of IPs associated with CobaltStrike C2 servers. In fact, the number of abusive IPs has not increased relative to BitLaunch's rapid infrastructure growth – it is just that more IP blocks are available overall.
At the time of writing, BitLaunch has 50 /24 prefixes announced over BGP, totalling 12,800 IP addresses. As a result, 82 C2s in 2024 represents just 0.6% of our IPs over the entire year. Across all first and third party hosts, abuse per month is around 1% of active servers.
We strongly disagree that BitLaunch is "not taking the appropriate steps to prevent their service from being used by ransomware and malware gangs". BitLaunch takes regular and concrete action against abuse, including no longer serving the Russian market. We employ a full-time, dedicated abuse team that already uses various tools to proactively and passively identify malicious servers. These tools include abuse.ch, urlscan, spamhaus, and more. Servers are suspended as soon as malicious activity is suspected, per our Acceptable Use policy.
The report implies that BitLaunch may be ignoring key red flags, such as accepting cryptocurrency from known illicit sources, and mentions that hosters can use blockchain analysis services to prevent this. BitLaunch already uses Elliptic for this purpose. We also disagree with the opinion that our service is "perfect for C2 servers and almost nothing else". As previously stated, abuse per month accounts for 1% of active servers despite BitLaunch accepting payments exclusively in cryptocurrency. There are numerous reasons to pay privately with cryptocurrency that do not involve illegal activity.
We believe the report fails to disclose a potential conflict of interest. The researcher works for Carrier Hotel Equinix, which serves some of our direct competitors. One such customer, PQ Hosting, is linked in the blog as a positive example of dealing with malicious activity.
Finally, we would like to thank BushidoToken for giving us a chance to issue this addendum. We welcome constructive critique on this topic and appreciate the opportunity to reflect on our abuse-prevention strategies and their communication."
The scourge of ransomware continues primarily because of
three main reasons: Ransomware-as-a-Service (RaaS), cryptocurrency, and safe havens.
RaaS platforms enable aspiring cybercriminals to join a gang and begin launching attacks with a support system that help extract ransom payments from their victims.
Cryptocurrency enables cybercriminals to receive funds from victims around the world without the option to freeze or refund them due to the immutable nature of the virtual funds.
Safe havens are countries that permit cybercriminals to launch attacks without immediate fear of arrest, enabling them to earn vast fortunes through ransomware campaigns.
With these three challenges in mind, law enforcement and
governments have a very difficult job to do when it comes to fighting ransomware
but fight it they must. In this blog we shall recall what counter-ransomware
activities took place in 2024, analyse their effectiveness, and assess how the
landscape shall evolve as a result.
A podcast version of this blog is also available here.
Ransomware Operator Arrests and Sanctions
During 2024, there were significant disruption operations by
law enforcement and financial authorities targeting individuals behind
ransomware campaigns (see the Table below). The main focus of 2024 for Western
law enforcement was squarely on the LockBit RaaS and its affiliates as it was
the largest and highest earning ransomware operation to date.
Several key players of the ransomware ecosystem were
arrested, including the main developer of LockBit ransomware. Interestingly,
Russian law enforcement also decided to arrest ransomware threat actors located
in Moscow and Kaliningrad as well.
European police took down malicious spam botnets that support ransomware campaigns. This resulted in 4 arrests (1 in Armenia and 3 in Ukraine), over 100 servers and 2,000 domains being seized. One of the main suspects earned €69 million by renting out infrastructure sites to deploy ransomware.
Deniss Zolotarjovs, a Latvian national was arrested and extradited to the US from Georgia for running the Karakurt data extortion gang linked to Conti.
Mikhail “Wazawaka” Matveev was arrested in Russia for violating domestic laws against the creation and use of malware. He was fined and had his cryptocurrency seized and is awaiting trial.
The ransomware ecosystem has fragmented due to the law enforcement disruptions of the largest players, such as
ALPHV/BlackCat and LockBit. In the case of ALPHV/BlackCat, the operators staged
a law enforcement takedown as they put up a fake seizure notice as part of
an exit scam in March 2024 after the attack on UnitedHealth.
Following these disruptions, some affiliates have migrated
to less effective strains or launched their own strains. This includes
Akira and RansomHub at the top of the list as well as Hunters International and
PLAY.
Cryptocurrency Exchanges Disrupted
During 2024, law enforcement seized funds from and
sanctioned a number of cryptocurrency exchanges and individuals running payment
processors using cryptocurrency (see the Table below).
One of the most interesting disclosures this year came from
the UK National Crime Agency (NCA) around Operation Destablise. The NCA linked
payments to ransomware gangs to money laundering networks used by Russian
oligarchs to covertly purchase property and Russia Today, the state-run media
organization, to covertly fund pro-Russia foreign entities.
Another notable investigation in 2024 was when the US
Treasury sanctioned more Russian cryptocurrency exchanges, such as PM2BTC and
Cryptex, that led to money launderers that facilitate the cashing out of ransom
payments being arrested by Russian law enforcement.
The US Justice Department indicted Russian national Roman Pikulev and Cryptonator, which processed a total of $1.4 billion in transactions, of which $8 million were ransom payments. Cryptonator also has ties to other sanctioned entities including Blender, Hydra Market, Bitzlato, and Garantex, among others.
FinCEN identified PM2BTC as being of “primary money laundering concern” in connection with Russian illicit finance. This was alongside Cryptex and Sergey Sergeevich Ivanov, a Russian national, who is associated with UAPS and PinPays, as well as Genesis Market. Cryptex also facilitated more than $115 million of proceeds from ransomware payments.
In Operation Final Exchange, German federal police (BKA) shut down 47 cryptocurrency exchange services that ransomware gangs use that operated without requiring registration or identity verification.
Russian authorities have arrested nearly 100 suspected cybercriminals linked to the anonymous payment system UAPS and the cryptocurrency exchange Cryptex.
The NCA uncovered a Russian money-laundering network operated by two companies called Smart and TGR Group as part of Operation Destabilise that involved UK-based cash-to-crypto networks that laundered Ryuk ransom payments as well as the money of Russian oligarchs and Russia Today.
Safe Havens Enabling Ransomware
While ransomware is a global problem, there are only a few
countries that are to blame for this rapid expansion of the ransomware
ecosystem. The state that is blamed the most for preventing many ransomware operators
from facing justice is Russia. There are explicit rules posted to
Russian-speaking cybercrime forums that state as long as members avoid
targeting Russia and the Commonwealth of Independent States (CIS), they are
free to operate.
The Russian ransomware safe haven theory was further proven
following sanctions levied against Evil Corp by the UK, US, and Australia. One
of the sanctioned men connected to Evil Corp was Eduard
Benderskiy, a former Russian federal security service (FSB) official.
Benderskiy is reportedly
the father-in-law of Maksim Yakubets, the leader of Evil Corp, an organized cybercrime
group responsible for multiple
ransomware strains including BitPaymer, WastedLocker, Hades, PhoenixLocker,
and MacawLocker. In total, Evil Corp has reportedly extorted at least $300
million from victims globally, according to the UK NCA. It is now clear that
Evil Corp has protection from a highly connected Russian FSB official who has
also been involved
in multiple overseas assassinations on behalf of the Kremlin, according to
Bellingcat investigators.
While a number of ransomware operators were arrested in 2024
and some were extradited to the US, the work done by law enforcement
specializing in cybercrime was put in the spotlight during the August
2024 prisoner swap. Multiple countries decided to release cybercriminals,
spies and an assassin as part of a historic
prisoner exchange with Russia at an airport in Ankara, Turkey. The US negotiated
the release of 16 people from Russia, including five Germans as well as seven
Russian citizens who were political prisoners in their own country.
Notably, from a cybercrime intelligence perspective, the Russian
nationals released from the West included the infamous cybercriminals Roman
Seleznev and Vladislav Klyushin. The latter, Klyushin, was sentenced
in 2023 to nine years in US prison after he was caught in a $93 million stock
market cheating scheme that involved hacking into US companies for insider
knowledge. The other cybercriminal, Seleznev, was sentenced
to 27 years in prison in 2017 for stealing and selling millions of credit card
numbers from 500 businesses using point-of-sale (POS) malware and causing more
than $169 million in damage to small businesses and financial institutions,
including those in the US.
In 2024, we saw several more Russian nationals get
extradited to the US after being arrested by law enforcement in the country
they were residing in. This includes the Phobos operator living in South Korea
and the LockBit developer living in Israel. This follows others arrested in
previous years such as a TrickBot developer arrested
in South Korea as well as the two LockBit affiliates extradited
to the US. There is a potential that these Russian nationals involved in
ransomware could be used in prisoner exchanges in the future.
Further, another curious trend in 2024 was that some Russians
inside Russia, which is firmly considered a safe haven for ransomware gang, did
get arrested. This includes the SugarLocker operators arrested in Moscow and
the LockBit affiliate Wazawaka who was arrested in Kaliningrad. This is
alongside the money launderers arrested around Russia linked to the Cryptex
exchange.
The arrests of Russian nationals in Russia for ransomware
activities appear to be more symbolic than a true crackdown on this type of
activity. This is because there are several dozen Russian-speaking ransomware
gangs that continue to operate, as well as a plethora of other types of cybercrime
in the Russian-speaking underground.
Outlook
In 2024, there was lots of significant action by law
enforcement to shake up the ransomware economy. One of the main successes of the
notable Operation Cronos action taken against LockBit was the sowing of
distrust and disharmony in the ransomware ecosystem. Despite the admins of
LockBit trying to recover, their reputation and army of affiliates have been
smashed.
Many of Russian law enforcement activities could all be
related to the costs of the Russian invasion of Ukraine. Russian authorities seizing funds of the illicit cryptocurrency exchanges could be to pay for
the war in Ukraine and they could be recruiting arresting cybercriminals for offensive
cyber operations related to the war in Ukraine. The true motivations of Russian law enforcement arresting these specific ransomware operators but allowing others to operate are unclear. The cybercriminals could also simply have not paid their protection money or lack connections in the FSB like Evil Corp has.
Due to the fall of LockBit and ALPHV/BlackCat
in 2024, there has been a rise of other ransomware groups like RansomHub and
Akira to fill the vacuum. However, the rate of attacks by these emerging groups
is still noticeably lower than when LockBit was operating at full force. This
should be perceived as a success for law enforcement operations in 2024 due to the overall
number of ransomware attacks lowering, which we should all be thankful
for.
Entrar
