Ransomware Attackers Continue to Avoid Voluntary Retirement

Unfounded legends persist, like the Loch Ness Monster and Bigfoot, alongside a more modern myth: ransomware hackers who voluntarily retire. Recently, a post on BreachForums by the group termed “Scattered Lapsus$ Hunters” claimed that members from the cybercrime factions Scattered Spider and ShinyHunters would cease their operations, suggesting they’ve amassed significant wealth.

Composed largely of Western adolescents skilled in social engineering, the Scattered Lapsus$ Hunters have been linked to several high-profile breaches impacting major sectors, including casinos, Salesforce customers, airlines, and even the luxury British automaker, Jaguar Land Rover. Despite the dubious claims of withdrawal, the message clarified that only the “least intelligent” members would be stepping back, while others would continue developing methods to exploit daily technologies, obscured in silence.

These “improvements” arise from individuals who often justify their destructive actions on critical infrastructures—such as hospitals—by labeling them mere “penetration testing.” However, just days after the supposed retirement announcement, threat intelligence firm ReliaQuest indicated new activities linked to Scattered Spider targeting financial services. This clearly indicates that the group’s promises of retirement were far from genuine.

“Retirement in cybercrime is a myth; what we’re witnessing is a classic display of operational security theater,” commented Roei Sherman, senior director of research at Mitiga Labs. He explains that the groups making these retirement proclamations are likely attempting to distance themselves from law enforcement scrutiny while planning to rebrand under new aliases after a cooling-off period. This cycle of behavior is predictable: increased scrutiny leads to claims of shutdowns, followed by resurfacing with modified tactics.

As John Fokker, head of threat intelligence at Trellix, articulates, the compulsive nature of cybercrime is not solely driven by financial gain. It offers a rapid accumulation of wealth combined with a lifestyle that can quickly become addictive. Factors such as ego, social status, and the thrill of evading capture further complicate the ease of stepping back from such activities.

Even when faced with formidable consequences, such as incarceration, some ransomware operatives persist in their illegal activities. Florida resident Noah Urban, sentenced to ten years in prison for his role in Scattered Spider operations, admitted to continuing his hacking endeavors even after federal investigators confiscated devices from his residence. Gregory Kehoe, the U.S. attorney for the Middle District of Florida, emphasized that the immersive nature of their online social networks makes it challenging for individuals to walk away, regardless of the severity of their circumstances.

The patterns emerging from these cybercriminal groups underscore the persistent and evolving tactics they employ, reflecting how foundational techniques like initial access, persistence, and privilege escalation remain central to their operations. As businesses navigate this precarious landscape, understanding these evolving threats and their implications is essential to enhancing cybersecurity measures.