ZeroFox Intelligence Flash Report - New Ransomware-as-a-Service Operation Claims Innovative Features

Product Serial: F-2024-04-25a

TLP:CLEAR

In this flash report, ZeroFox researchers report on a new, innovative ransomware-as-a-service operation announced in the deep and dark web forum, RAMP.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On April 19, 2024, positive-reputation threat actor “Bezzle” announced a new ransomware-as-a-service (Raas) operation named “Apos” in the Russian-speaking deep and dark (DDW) community RAMP. Bezzle proclaims Apos is the “fastest” and “most technically advanced” product on the market.
Apos purportedly has many software features that are typically only observed amongst the more advanced RaaS offerings. The service also includes highly uncommon capabilities, which is very likely indicative of an attempt to separate the Apos service from its competition and appeal to potential affiliates.
RaaS offerings are very likely to become increasingly competitive during 2024, with collectives offering affiliates more software features, better technical support and digital infrastructure, higher payouts, and loyalty incentives.