Nine emerging groups shaping the ransomware landscape

Artificial intelligence (AI) has lowered the barrier to entry for cybercriminals, allowing ransomware threat actors to automate coding, generate polymorphic malware — which alters its code with each infection to evade detection — and create more convincing social engineering lures.

As a result, new groups are emerging rapidly, and established groups are scaling their operations.

Ransomware groups typically leverage crypto to demand and receive cross-border payments anonymously. Bitcoin is the most common cryptocurrency requested by ransomware operators, though Monero is also used by some groups due to its privacy features. Both former and active ransomware groups — like BlackSuit, DragonForce, and Akira — convert proceeds from bitcoin  into other cryptocurrencies like Ethereum, Tron, Binance Smart Chain, and Arbitrum throughout the laundering process.

Read more at TRM Labs