Cicada3301 and Crypt Ghouls Use LockBit 3.0 and Babuk Ransomware to Target UK and Russian Firms

Cicada3301, a ransomware group emerging in 2024, has quickly targeted UK businesses with aggressive tactics and sophisticated encryption methods. The group operates a ransomware-as-a-service (RaaS) model, and its affiliate program was recently infiltrated by Group-IB researchers, who published new details about the gang’s affiliate panel and ransomware strains. Meanwhile, another ransomware group, Crypt Ghouls, is disrupting Russian organizations by exploiting VPNs and subcontractors' login credentials. They have been using LockBit 3.0 and Babuk ransomware in their attacks.