ZeroFox Intelligence Flash Report - Introducing Wing, New Ransomware-as-a-Service

ZeroFox Intelligence Flash Report - Introducing Wing, New Ransomware-as-a-Service

Product Serial: F-2024-01-30c

TLP:CLEAR

In this flash report, ZeroFox researchers report on the announcement of a new Ransomware-as-a-Service (RaaS) operation known as Wing on the predominantly Russian-speaking dark web forum RAMP; it is the first RaaS launched on the forum in 2024.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• On January 28, 2024, positive-reputation English-speaking actor “blackhunt” announced a new Ransomware-as-a-Service (RaaS) operation known as Wing on the predominantly Russian-speaking dark web forum RAMP; it is the first RaaS launched on the forum in 2024.
• Wing Ransomware is touted as a state-of-the art ransomware tool with multiple features designed to facilitate effective deployment and defense evasion.
• At the time of writing, ZeroFox has observed no instances of active deployment of the Wing Ransomware strain, although victims are likely to emerge in coming weeks.
• However, the announcement of the RaaS operation in English-only is indicative of the trend observed in Q4 2023 whereby English-speaking actors are willing to enter the ransomware scene, traditionally dominated by Russian-speaking operatives.