{"id":203515,"date":"2024-03-17T13:25:14","date_gmt":"2024-03-17T13:25:14","guid":{"rendered":"https:\/\/www.techopedia.com\/?p=203515"},"modified":"2024-03-17T13:25:13","modified_gmt":"2024-03-17T13:25:13","slug":"are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war","title":{"rendered":"Are Law Enforcement Crackdowns Fueling a Ransomware Gang War?"},"content":{"rendered":"<p>The FBI&#8217;s enforcement actions in coordination with CISA and international partners against cyber crime operations seem to be changing how <a href=\"https:\/\/www.techopedia.com\/definition\/4337\/ransomware\">ransomware<\/a> gangs operate.<\/p>\n<p>Techopedia sats with leading <a href=\"https:\/\/www.techopedia.com\/definition\/24747\/cybersecurity\">cybersecurity<\/a> experts to understand how power vacuums work in the illicit industry, how law enforcement actions reshape the dark web, and whether there will ever be an end to ransomware.<\/p>\n<div class=\"su-note\"  style=\"border-color:#dddddd;border-radius:3px;-moz-border-radius:3px;-webkit-border-radius:3px;\"><div class=\"su-note-inner su-u-clearfix su-u-trim\" style=\"background-color:#f7f7f7;border-color:#ffffff;color:#333333;border-radius:3px;-moz-border-radius:3px;-webkit-border-radius:3px;\">\n<h2><span id=\"key_takeaways\">Key Takeaways<\/span><\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\">The FBI, CISA, and international law enforcement agencies have leveled up their actions, disrupting major ransomware networks and operations.<\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">LockBit and BlackCat \u2013 two of the most prolific ransomware gangs \u2014 have either been dismantled or driven underground.<\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">Experts are detecting increased ransomware activity from gangs that are trying to fill the power vacuum left by BlackCat and LockBit.<\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">Cybersecurity organizations have also detected new partnerships among ransomware gangs that build upon the strength of the Five Families criminal syndicate.<\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">Experts debate about new techniques in use, new and old players, and why the end of ransomware is no way near.<\/li>\n<\/ul>\n<\/div><\/div>\n<div>\n    <section class=\"toc-sticky w-100 bg-white \">\n        <div class=\"toc-sticky__container container\">\n            <div class=\"toc-sticky__open d-flex align-items-end\" data-bs-toggle=\"collapse\"\n                 aria-controls=\"multiCollapse1\"\n                 data-bs-target=\"#multiCollapse1\">\n                <button\n                        class=\"btn btn-primary collapse-action-btn p-1 rounded-circle\"\n                        type=\"button\"\n                >\n                    <i class=\"icon-chevron-up\"><\/i>\n                <\/button>\n                <span id=\"toc-current-title\" class=\"d-flex align-items-center\">\n                    Table of Contents\n                <\/span>\n                <span class=\"toc-main-title-permanent\">Table of Contents<\/span>\n            <\/div>\n            <div\n                    class=\"collapse my-3\"\n                    id=\"multiCollapse1\"\n            >\n                <ol class=\"StepProgress\">\n                                                                        <li class=\"StepProgress-item current\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"key_takeaways\"\n                               onclick=handleScrollToTitle(\"key_takeaways\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Key Takeaways<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"ransomware_gangs_partnering_up\"\n                               onclick=handleScrollToTitle(\"ransomware_gangs_partnering_up\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Ransomware Gangs Partnering Up<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"the_five_families_the_cybercriminal_syndicate_that_runs_the_show\"\n                               onclick=handleScrollToTitle(\"the_five_families_the_cybercriminal_syndicate_that_runs_the_show\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">The Five Families: The Cybercriminal Syndicate That Runs The Show<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"law_enforcement_and_newtons_third_law\"\n                               onclick=handleScrollToTitle(\"law_enforcement_and_newtons_third_law\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Law Enforcement and Newton's Third Law<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"new_ransomware_extortion_techniques_to_fly_under_the_radar\"\n                               onclick=handleScrollToTitle(\"new_ransomware_extortion_techniques_to_fly_under_the_radar\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">New Ransomware Extortion Techniques To Fly Under the Radar<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"the_end_of_ransomware\"\n                               onclick=handleScrollToTitle(\"the_end_of_ransomware\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">The End of Ransomware<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"the_bottom_line\"\n                               onclick=handleScrollToTitle(\"the_bottom_line\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">The Bottom Line<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                    <\/ol>\n                <div class=\"toc-sticky__container__disperse\"><\/div>\n                <div class=\"toc-sticky__btn-top justify-content-center\">\n                    <button class=\"btn btn-link d-flex align-items-center\" onclick={btnTop()}><p>Show Full Guide<\/p><img decoding=\"async\"\n                                src=\"\/wp-content\/plugins\/table-of-contents\/assets\/images\/arrow-up-circle.svg\"\n                                alt=\"arrow-up-circle\">\n                    <\/button>\n                <\/div>\n            <\/div>\n        <\/div>\n    <\/section>\n    <div class=\"toc-sticky-list\">\n        <div class=\"toc-sticky__container container\">\n            <div class=\"toc-sticky__open d-flex align-items-end\" data-bs-toggle=\"collapse\" aria-controls=\"multiCollapse2\" data-bs-target=\"#multiCollapse2\">\n                <button class=\"btn btn-primary collapse-action-btn p-1 rounded-circle\"\n                        type=\"button\">\n                    <i class=\"icon-chevron-up up\"><\/i>\n                <\/button>\n                <span id=\"toc-current-title\" class=\"d-flex align-items-center\">\n                    Table of Contents\n                <\/span>\n            <\/div>\n            <div  class=\"collapse my-3\" id=\"multiCollapse2\">\n                <ol class=\"StepProgress\">\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item current \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"key_takeaways\"\n                                   onclick=handleScrollToTitle(\"key_takeaways\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Key Takeaways<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"ransomware_gangs_partnering_up\"\n                                   onclick=handleScrollToTitle(\"ransomware_gangs_partnering_up\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Ransomware Gangs Partnering Up<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"the_five_families_the_cybercriminal_syndicate_that_runs_the_show\"\n                                   onclick=handleScrollToTitle(\"the_five_families_the_cybercriminal_syndicate_that_runs_the_show\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">The Five Families: The Cybercriminal Syndicate That Runs The Show<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t\n\t\t\t\t\t\t <span class=\"show_moretoc\">Show Full Guide<\/span>\n\t\t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"law_enforcement_and_newtons_third_law\"\n                                   onclick=handleScrollToTitle(\"law_enforcement_and_newtons_third_law\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Law Enforcement and Newton's Third Law<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"new_ransomware_extortion_techniques_to_fly_under_the_radar\"\n                                   onclick=handleScrollToTitle(\"new_ransomware_extortion_techniques_to_fly_under_the_radar\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">New Ransomware Extortion Techniques To Fly Under the Radar<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"the_end_of_ransomware\"\n                                   onclick=handleScrollToTitle(\"the_end_of_ransomware\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">The End of Ransomware<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"the_bottom_line\"\n                                   onclick=handleScrollToTitle(\"the_bottom_line\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">The Bottom Line<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                                    <\/ol>\n            <\/div>\n            <div class=\"toc-sticky__container__disperse\"><\/div>\n        <\/div>\n    <\/div>\n<\/div>\n\n<script id=\"toc-js\">\n    window.addEventListener(\"DOMContentLoaded\", () => {\n        const header = document.querySelector(\".header_wrapper\");\n\n        const pageLegend = document.querySelector('#multiCollapse1');\n        const pageLegendList = document.querySelector('#multiCollapse2');\n        const pageLegendCollapse = new bootstrap.Collapse(pageLegend, {toggle: document.querySelector(\".toc-sticky\").classList.contains('sticky')});\n\n        \/**\n         * Changing current title\n         *\/\n        (function (pageLegend) {\n            const titleNodes = pageLegend.querySelectorAll('.StepProgress-item__link');\n\n            if (!titleNodes.length) return;\n\n            const titles = [...titleNodes].map((itm, i) => ({\n                id: itm.getAttribute('data-id'),\n                text: itm.textContent,\n                level: itm.getAttribute('data-level'),\n                linkNode: itm,\n                titleNode: document.getElementById(itm.getAttribute('data-id')),\n                index: i,\n            }));\n\n            \/**\n             * Source: https:\/\/www.sitepoint.com\/throttle-scroll-events\/\n             * @param {Function} fn\n             * @param {number} wait\n             * @returns {(function(): void)|*}\n             *\/\n            const throttle = (fn, wait) => {\n                let time = Date.now();\n                return function () {\n                    if ((time + wait - Date.now()) < 0) {\n                        fn();\n                        time = Date.now();\n                    }\n                }\n            }\n\n            const changeCurrentTitle = () => {\n                const documentScrollTop = window.pageYOffset || document.documentElement.scrollTop || document.body.scrollTop || 0;\n                let current = 0;\n\n                \/\/ Title\n                titles.forEach((itm, i) => {\n\t\t\t\t\/\/console.log(itm)\n                    const itmOffsetTop = itm.titleNode ? itm.titleNode.offsetTop - 100 : 0;\n\n                    if (documentScrollTop >= itmOffsetTop) {\n                        document.getElementById('toc-current-title').innerHTML = itm.text;\n                        document.getElementById('toc-current-title').setAttribute('data-current-id', itm.id);\n                        document.getElementById('toc-current-title').setAttribute('data-current-level', itm.level);\n                        current = i;\n                    }\n                })\n\n                \/\/ close all list and open sub list if needed\n                if (document.querySelector(\".toc-sticky\").classList.contains('sticky')) {\n                    document.querySelectorAll('.subList-in-progress').forEach((el) => {\n                        el.children[1].classList.remove('show');\n                        el.getElementsByClassName('icon-chevron-down')[0].classList.remove('up');\n                    });\n                    const currentEl = titles[current];\n                    currentEl.linkNode.classList.add('show');\n                }\n\n                titles.forEach((itm, i) => {\n                    itm.linkNode.parentNode.parentNode.classList.remove('current', 'is-done');\n                    if (current > i) {\n                        itm.linkNode.parentNode.parentNode.classList.add('is-done')\n                    };\n                    if (current === i) {\n                      itm.linkNode.parentNode.parentNode.classList.add('current');\n                    };\n                })\n\n            }\n\n            changeCurrentTitle();\n\n            document.addEventListener('scroll', throttle(changeCurrentTitle, 50));\n        })(pageLegend);\n\n\n        \/**\n         *  Collapse\n         *\/\n        (function (pageLegend, header) {\n            const icon = pageLegend.parentNode.querySelector(\".collapse-action-btn i\");\n\n            const collapseToggle = (status) => (e) => {\n                if (!e.target.isEqualNode(pageLegend)) return;\n\n                icon.classList.toggle(\"up\");\n\n                const containerHeight = pageLegend.getBoundingClientRect().height;\n\n                const showSubtitleContent = () => {\n                    const currentId = document.getElementById('toc-current-title').getAttribute('data-current-id');\n                    const currentLevel = document.getElementById('toc-current-title').getAttribute('data-current-level');\n                    const currentSubTitle = currentLevel == 3 ? document.querySelector(`a[data-id=\"${currentId}\"]`).parentNode.parentNode.parentNode : false;\n\n                    if (!currentSubTitle) return;\n                    new bootstrap.Collapse(currentSubTitle, {toggle: false}).show();\n                }\n\n                showSubtitleContent();\n                if (status === 'shown' && document.querySelector(\".toc-sticky\").classList.contains('sticky') ) {\n                    document.querySelector('html').classList.remove('overflow-hidden');\n                    pageLegend.classList.add('overflow-auto');\n                    pageLegend.style.height = `calc(100vh - ${header.getBoundingClientRect().height + document.querySelector('.toc-sticky__open').getBoundingClientRect().height + 16}px)`;\n                } else if (status === 'hide') {\n                    document.querySelector('html').classList.remove('overflow-hidden');\n                    pageLegend.classList.remove('overflow-auto');\n                    pageLegend.style.height = 'auto';\n                }\n            }\n\n            pageLegend.addEventListener('shown.bs.collapse', collapseToggle('shown'));\n            pageLegend.addEventListener('hide.bs.collapse', collapseToggle('hide'));\n        })(pageLegend, header);\n\n        \/**\n         * Collapse sub-titles\n         *\/\n        (function (pageLegend) {\n            const collapseEls = pageLegend.querySelectorAll('.collapse');\n\n            collapseEls.forEach(function (el) {\n\n                const toggleArrowDirection = function (e) {\n                    if (!e.target.isEqualNode(el)) return;\n\n                    const id = this.getAttribute('id');\n                    document.querySelector(`.collapse-action-btn[data-bs-target=\"#${id}\"] .icon-chevron-down`).classList.toggle('up');\n                }\n                el.addEventListener('shown.bs.collapse', toggleArrowDirection);\n                el.addEventListener('hide.bs.collapse', toggleArrowDirection);\n            })\n        })(pageLegend);\n\n        \/**\n         *  Collapse main title\n         *\/\n        (function (pageLegendList) {\n            const icon = pageLegendList.parentNode.querySelector(\".collapse-action-btn i\");\n\n            const collapseToggle = () => (e) => {\n                if (!e.target.isEqualNode(pageLegendList)) return;\n\n                icon.classList.toggle(\"up\");\n\n            }\n            pageLegendList.addEventListener('shown.bs.collapse', collapseToggle());\n            pageLegendList.addEventListener('hide.bs.collapse', collapseToggle());\n        })(pageLegendList);\n\n        (function (pageLegendList) {\n            const collapseEls = pageLegendList.querySelectorAll('.collapse');\n\n            collapseEls.forEach(function (el) {\n\n                const toggleArrowDirection = function (e) {\n                    if (!e.target.isEqualNode(el)) return;\n\n                    const id = this.getAttribute('id');\n                    document.querySelector(`.toc-sticky-list .collapse-action-btn[data-bs-target=\"#${id}\"] .icon-chevron-down`).classList.toggle('up');\n                }\n                el.addEventListener('shown.bs.collapse', toggleArrowDirection);\n                el.addEventListener('hide.bs.collapse', toggleArrowDirection);\n            })\n        })(pageLegendList);\n\n        \/**\n         * Sticky functionality\n         * Source: https:\/\/stackoverflow.com\/questions\/17893771\/javascript-sticky-div-after-scroll\n         *\/\n        (function (header, pageLegendCollapse) {\n            \/\/ set everything outside the onscroll event (less work per scroll)\n            const target = document.querySelector(\".toc-sticky\");\n            const targetListStatic = document.querySelector(\".toc-sticky-list\");\n\n            if (!target || !header) return;\n\n            const headerHeight = header.getBoundingClientRect().height;\n            const targetHeight = targetListStatic.getBoundingClientRect().height;\n\n            \/\/ -headerHeight so it won't be jumpy\n            const stop = targetListStatic.offsetTop + headerHeight + targetHeight;\n            const docBody =\n                document.documentElement || document.body.parentNode || document.body;\n            const hasOffset = window.pageYOffset !== undefined;\n\n            const applySticky = function () {\n                \/\/ cross-browser compatible scrollTop.\n                const scrollTop = hasOffset ? window.pageYOffset : docBody.scrollTop;\n\n                \/\/ if user scrolls to headerHeight from the top of the target div\n                if (scrollTop >= stop) {\n                    pageLegendCollapse.hide();\n                    \/\/ stick the div\n                    target.classList.add(\"sticky\");\n                    \/\/target.style.marginTop = `${headerHeight}px`;\n                } else {\n                    pageLegendCollapse.show();\n                    \/\/ release the div\n                    target.classList.remove(\"sticky\");\n                    target.style.marginTop = \"\";\n                }\n            }\n\n            applySticky();\n\n            window.addEventListener('scroll', applySticky);\n        })(header, pageLegendCollapse);\n\tjQuery('span.show_moretoc').click(function(){\n\t\tjQuery('span.show_moretoc').hide();\n\t   jQuery('.ms_hidetoc').show();\n\t});\n    });\n\n    \/\/ When the user clicks on the button, scroll to the top of the document\n    function btnTop() {\n        const pageLegend = document.querySelector('#multiCollapse1');\n        document.querySelector('html').classList.remove('overflow-hidden');\n        pageLegend.classList.remove('overflow-auto');\n        pageLegend.style.height = 'auto';\n        window.scrollTo({\n            top: 0,\n            behavior: 'smooth'\n        });\n    }\n\n    const handleScrollToTitle = (id) => {\n        const el = document.getElementById(id);\n        const headerHeightDifference = window.innerWidth < 992 ? -30 : -15;\n        window.scrollTo({\n            top: el.offsetTop - 60 - headerHeightDifference - 10,\n        });\n    }\n<\/script>\n\n<h2><span id=\"ransomware_gangs_partnering_up\">Ransomware Gangs Partnering Up<\/span><\/h2>\n<p>While major ransomware players go down, including Lockbit \u2014 <a href=\"https:\/\/www.theregister.com\/2024\/03\/14\/lockbit_ransomware_criminal_sentenced\/\" target=\"_blank\">recently dismantled<\/a> \u2014 and <a href=\"https:\/\/www.cpomagazine.com\/cyber-security\/under-increasing-federal-scrutiny-blackcat-ransomware-gang-pulls-exit-scam-on-its-way-out\/\" target=\"_blank\">BlackCat (ALPHV) going underground<\/a> due to FBI heat, other ransomware operators are seizing the moment.<\/p>\n<p>The GhostSec and Stormous groups, who have collaborated in double extortion attacks in the past, <a href=\"https:\/\/thehackernews.com\/2024\/03\/alert-ghostsec-and-stormous-launch.html\" target=\"_blank\">are now thought to have partnered up<\/a>. However, the move signals to a bigger scheme and threat rapidly approaching on the horizon.<\/p>\n<h3>Malware and Ransomware-As-A-Service Creates Connections<\/h3>\n<p><a href=\"https:\/\/silverjacket.mxspruce.com\/60da58dd67b70018824684dd\/l\/K2Um98LoEcSUKZSyp?rn=ioXZk5WYuJXZGBSehJlI&amp;re=gIt92YuwWah12ZAJTMzMzbylWbhJnI&amp;sc=false\" target=\"_blank\"><b>Richard Caralli<\/b><\/a>, Senior Cybersecurity Advisor at <a href=\"https:\/\/silverjacket.mxspruce.com\/60da58dd67b70018824684dd\/l\/PKgb26z2S42cUxGsV?rn=ioXZk5WYuJXZGBSehJlI&amp;re=gIt92YuwWah12ZAJTMzMzbylWbhJnI&amp;sc=false\" target=\"_blank\"><b>Axio<\/b><\/a>, a SaaS-cyber risk quantification solutions company, explained why ransomware gangs are partnering up and what type of partnership they forge.<\/p>\n<blockquote><p>\u201cThe similarity of attacks and attack methods exhibited in the recent Clorox, MGM, and Caesars intrusions would at least anecdotally imply that there is coordination between ransomware gangs, particularly in the trading of tools, techniques, and methods.\u201d<\/p><\/blockquote>\n<p>Caralli explained that the black market for <a href=\"https:\/\/www.techopedia.com\/definition\/32410\/ransomware-as-a-service-raas\">ransomware-as-a-service<\/a> and <a href=\"https:\/\/www.techopedia.com\/definition\/4015\/malicious-software-malware\">malware<\/a>-as-a-service lowers the technical bar for bad actors and increases accessibility \u2014 and also leads to collaboration.<\/p>\n<p>Partnering up is a common strategy, but on the <a href=\"https:\/\/www.techopedia.com\/definition\/31562\/dark-web\">Dark Web<\/a>, being on the same team does not necessarily mean the same thing as it does for everyone, Caralli explained.<\/p>\n<p>&#8220;The proliferation of ransomware-as-a-service is a connecting feature, if only by virtue of the degree to which many gangs use similar malware in their attack vectors,&#8221; Caralli said.<\/p>\n<blockquote><p>\u201cIn this case, &#8216;teaming up&#8217; may be less intentional and more related to the burgeoning underground trade of malware and exfiltrated data.\u201d<\/p><\/blockquote>\n<h3>The Power Vacuum in the Ransomware Industry<\/h3>\n<p>Like in any other criminal environment, when top players are removed from the ransomware frontline, the power vacuum may lead to new leadership or established groups taking over. Caralli from Axio explained just how big a vacuum BlackCat is leaving.<\/p>\n<p>&#8220;In 2024, the most noteworthy attacks appear to be executed by the ALPHV\/BlackCat gang, particularly against high-value targets,&#8221; Caralli said.<\/p>\n<p>In addition to notable attacks against MGM and Henry Schein, they are implicated in the Prudential Financial, Change Healthcare, and Loan Depot attacks so far this year.<\/p>\n<blockquote><p><strong>\u201cBlackCat operates as a ransomware-as-a-service model, so it is likely that other attack gangs have access to and have used their malware in similar attacks, possibly on lower value targets.\u201d<\/strong><\/p><\/blockquote>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/javvad\" target=\"_blank\"><b>Javvad Malik<\/b><\/a>, Lead Security Awareness Advocate at <a href=\"http:\/\/www.knowbe4.com\" target=\"_blank\"><b>KnowBe4<\/b><\/a>, also spoke to Techopedia about the issue.<\/p>\n<blockquote><p>&#8220;The collaboration between the GhostSec and Stormous groups marks a significant evolution in the ransomware landscape, reflecting a tactical shift in how cybercriminals operate to enhance their effectiveness and resilience against law enforcement actions.\u201d<\/p><\/blockquote>\n<p>Malik explained that gangs are teaming up to pool resources, share knowledge, and diversify their attack techniques. &#8220;This collaboration allows them to target more victims more efficiently and evade detection and countermeasures more effectively,&#8221; Malik said.<\/p>\n<blockquote><p>\u201cLaw enforcement actions, such as those disrupting LockBit operations, create a power vacuum within the cybercriminal ecosystem. Other groups see this as an opportunity to ascend in prominence and fill the gap left behind.\u201d<\/p><\/blockquote>\n<p>Malik said this can lead to a surge in activity as emerging groups attempt to establish dominance and prove themselves, often innovating to avoid their predecessors&#8217; fates.<\/p>\n<h2><span id=\"the_five_families_the_cybercriminal_syndicate_that_runs_the_show\">The Five Families: The Cybercriminal Syndicate That Runs The Show<\/span><\/h2>\n<p>The new collaboration between GhostSec and Stormous is not new, in fact, it is built upon a larger partnership: the Five Families.<\/p>\n<p>Ngoc Bui, Security Expert at <a href=\"https:\/\/www.menlosecurity.com\/\" target=\"_blank\">Menlo Security<\/a>, described the new partnership as the tip of the iceberg.<\/p>\n<blockquote><p>\u201cThis merger is merely the tip of the iceberg, as these gangs are integral components of a larger, newly formed Five Families.\u201d<\/p><\/blockquote>\n<p>Bui explained that this criminal alliance further strengthens the group&#8217;s operational capabilities.<\/p>\n<blockquote><p>\u201cBefore the LockBit saga and the FBI&#8217;s involvement, rumors popped up regarding LockBit&#8217;s potential induction into the Five Families, though the extent of this integration remains unknown.\u201d<\/p><\/blockquote>\n<p>Created and openly announced on Telegram and hacker forums in 2023, the Five Families includes five hacker groups. ThreatSec, GhostSec, Stormous, Blackforums, and SiegedSec.<\/p>\n<p>The name Five Families not only refers to the 1950s New York mafia families but also teases the famous &#8220;Five Eyes&#8221; intelligence alliance \u2014 U.S., U.K., Canada, Australia, and New Zealand.<\/p>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/nphyatt\/\" target=\"_blank\">Nick Hyatt<\/a>, Director of Threat Intelligence at <a href=\"https:\/\/blackpointcyber.com\/\" target=\"_blank\">Blackpoint Cyber<\/a>, said it was no surprise to see GhostSec and Stormus partnering up.<\/p>\n<blockquote><p>\u201cGiven that GhostSec and Stormous are part of a group known as the Five Families, it makes sense that they would work together.\u201d<\/p><\/blockquote>\n<h3>Is The New Five Families RaaS Taking Over?<\/h3>\n<p>The Five Families have conducted joint-cybercriminal Pro-Palestine operations and breached organizations around the world, introducing the GhostLocker ransomware. Now, <a href=\"https:\/\/blog.talosintelligence.com\/ghostsec-ghostlocker2-ransomware\/\" target=\"_blank\">CISO<\/a> assures that GhostSec has evolved with a new GhostLocker 2.0 ransomware and describes it as &#8220;a Golang variant of the GhostLocker ransomware&#8221;.<\/p>\n<p>They announced a new ransomware-as-a-service (RaaS). With Lockbit and BlackCat out of the RaaS world, the new Five Families ransomware variant could be the next big thing in threat intelligence and cybersecurity.<\/p>\n<h2><span id=\"law_enforcement_and_newtons_third_law\">Law Enforcement and Newton&#8217;s Third Law<\/span><\/h2>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/chrisanthonytwx\" target=\"_blank\"><b>Chris Anthony<\/b><\/a> \u2014 a military veteran who spent most of his career with the Army Rangers, 10th Special Forces Group, and the Intelligence community \u2014 and is today the CEO of <a href=\"https:\/\/www.teamworxsecurity.com\/\" target=\"_blank\"><b>TeamWorx Security<\/b><\/a>, spoke with Techopedia about action and reaction in cybersecurity.<\/p>\n<blockquote><p>\u201cWhile law enforcement activity disrupts and delays the gangs\u2019 operations, these gangs have ultimately reemerged. The vacuum exists in the affiliate programs, which are smaller groups that operate the ransomware on behalf of the larger gang.<\/p>\n<p>&nbsp;<\/p>\n<p>\u201cAs a group is taken down, its affiliates are looking for a new Ransomware-as-a-Service group to join. Other ransomware gangs take advantage of this and seek to pull these affiliate groups into their network.\u201d<\/p><\/blockquote>\n<p>Bui from Menlo also said that enforcement actions often have indirect effects.<\/p>\n<blockquote><p>\u201cThe response of law enforcement to `top tier&#8217; ransomware gangs, while impactful, often serves as a learning curve rather than a deterrent for other criminal factions. The disruption often fails to create a significant power vacuum, instead providing a blueprint for remaining groups to refine their operations and solidify inter-gang relationships.\u201d<\/p><\/blockquote>\n<p>Hyatt added: &#8220;More often, you will find unaffiliated groups targeting similar organizations, largely due to groups sharing tactics, techniques, and procedures for exploitation.<\/p>\n<blockquote><p>\u201cLaw enforcement action tends to have a ripple effect across criminal organizations. As groups are disrupted, they will disappear and rebrand. It can be compared to fighting the hydra \u2013 you cut off one head, another pops up.\u201d<\/p><\/blockquote>\n<p>Hyatt assured that Blackpoint Cyber data shows that with ALPHV and Lockbit disrupted, groups like BlackBasta, Play, and Medusa have stepped up to fill the void.<\/p>\n<h2><span id=\"new_ransomware_extortion_techniques_to_fly_under_the_radar\">New Ransomware Extortion Techniques To Fly Under the Radar<\/span><\/h2>\n<p>Ransomware attacks have long been a nightmare for businesses and individuals alike. But the game just got a whole lot more complex. Ransomware gangs are evolving their tactics, moving beyond simple encryption to a multi-layered extortion strategy. Hyatt from Blackpoint Cyber explained some new tactics.<\/p>\n<blockquote><p>\u201cMore and more, we see groups moving to a pure exfiltration and extortion tactic. Instead of encrypting the environment, groups will do a smash-and-grab \u2013 exploit a vulnerability, get into an environment, exfiltrate the data, and then ask for a ransom to prevent the distribution of the data.\u201d<\/p><\/blockquote>\n<p>Using this extortion method, criminals have a higher chance of success, Hyatt said. &#8220;By focusing on just exfiltrating the data rather than encrypting it, the groups can run under the radar of security teams by not triggering traditional defense tools.<\/p>\n<p>Bui agreed and said that new ransomware tactics fit the category of plain old blackmail that promises to become more threatening in the near future.<b>\u00a0<\/b><\/p>\n<blockquote><p>\u201cIn terms of extortion tactics, the landscape is continually evolving, with some criminals increasingly leveraging stolen data for blackmail purposes, indicating a possible transition towards more nuanced forms of extortion.\u201d<\/p><\/blockquote>\n<p>Anthony of TeamWorx Security added that the era of triple ransomware extortion has begun.<\/p>\n<p>&#8220;Previously, ransomware gangs would encrypt data and offer it for sale on their leak sites. However, ransomware gangs found that companies would refuse to pay or revert to backups, denying the ransomware gangs their payment.<\/p>\n<blockquote><p>\u201cRansomware groups want to put more pressure on the companies to pay and have now begun to encrypt, sell, and launch another attack against the company on top of their initial data theft.\u201d<\/p><\/blockquote>\n<h2><span id=\"the_end_of_ransomware\">The End of Ransomware<\/span><\/h2>\n<p>It came to us as no surprise that of all the experts we interviewed for this story, not one believed that a near-future world without ransomware is possible.<\/p>\n<p>&#8220;Ransomware attacks are unlikely to abate anytime soon,&#8221; Caralli said. &#8220;A recent statement from the 50 members of the <a href=\"https:\/\/silverjacket.mxspruce.com\/60da58dd67b70018824684dd\/l\/KYIYWOIm9KywEDLjw?rn=ioXZk5WYuJXZGBSehJlI&amp;re=gIt92YuwWah12ZAJTMzMzbylWbhJnI&amp;sc=false\" target=\"_blank\">International Counter Ransomware Initiative<\/a> confirms that the velocity of ransomware attacks continues to grow.<\/p>\n<p>&#8220;Certainly, if organizations push back stridently with respect to paying (or being open to negotiating) ransoms, we might see some abatement, but this is unlikely to occur on a wide scale,&#8221; Caralli added.<\/p>\n<blockquote><p>\u201cCompanies that get hit with ransomware know that the costs associated with such an attack increase exponentially the longer they are in the news, so an essential part of a recovery strategy is to corral the damage as quickly as possible and get out of the headlines.\u201d<\/p><\/blockquote>\n<p>Caralli added that ransomware techniques are easy to execute and are profitable for criminal groups.<\/p>\n<blockquote><p>\u201cThe ease of executing a ransomware attack combined with general unpreparedness to fend off such attacks contributes to the problem.\u201d<\/p><\/blockquote>\n<p>Malik said that the end of ransomware does not seem imminent and called for organizations to level up social engineering security policies as this is the main gateway through which ransomware operators breach organizations over and over.<\/p>\n<blockquote><p>\u201cIts eradication would require a multifaceted approach, including enhanced cybersecurity measures, international collaboration on law enforcement.\u201d<\/p><\/blockquote>\n<p>Hyatt from Blackpoint Cyber also spoke about the government&#8217;s role in putting an end to the criminal trend.<\/p>\n<blockquote><p>\u201cUntil the federal government makes a concerted effort to partner with the security industry and make an investment in cybersecurity outside of lip service to stopping ransomware, we will continue to see it be a plague.<\/p><\/blockquote>\n<p>&#8220;Law enforcement takedowns of ransomware gangs are fantastic, and the folks doing them are doing great work, but these investigations take a long time to conduct and are just a drop in the bucket.&#8221;<\/p>\n<p>Anthony, CEO of TeamWorx Security, jumped into the debate.<\/p>\n<blockquote><p>\u201cRansomware will end when there is no money to make in ransomware attacks and countries where the gangs are based stop enabling the groups. The proliferation of cyber insurance, which may include policies to pay ransoms, may increase the profitability and likelihood of launching ransomware attacks.\u201d<\/p><\/blockquote>\n<h2><span id=\"the_bottom_line\">The Bottom Line<\/span><\/h2>\n<p>While the world welcomes international law enforcement actions against cybercriminals, recent and historical events show that when one ransomware group is disrupted, even a big one, ransomware attacks do not stop.<\/p>\n<p>Furthermore, experts believe law enforcement actions do affect the criminal underworld, with cybercriminals and ransomware gangs taking bold actions, making alliances, and running dangerous hacks to show off their capabilities.<\/p>\n<p>The ransomware market has industrialized, ransomware services are on the rise, geopolitical tensions continue to spill into cyberspace, and ransomware gangs and their affiliates continue leveling the field using low-risk, high-reward tactics.<\/p>\n<p>In this highly dynamic environment, there are still many powerful players in the criminal game to pick up the torch of the dismantled and lead, while others regroup and resurface with new aliases and new ransomware technologies.<\/p>\n<p>The end of ransomware is nowhere in sight.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The FBI&#8217;s enforcement actions in coordination with CISA and international partners against cyber crime operations seem to be changing how ransomware gangs operate. Techopedia sats with leading cybersecurity experts to understand how power vacuums work in the illicit industry, how law enforcement actions reshape the dark web, and whether there will ever be an end [&hellip;]<\/p>\n","protected":false},"author":286688,"featured_media":203518,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_lmt_disableupdate":"no","_lmt_disable":"","om_disable_all_campaigns":false,"footnotes":""},"categories":[585,548],"tags":[],"category_partsoff":[],"class_list":["post-203515","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-threats","category-cybersecurity"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.2 (Yoast SEO v24.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Are Enforcement Crackdowns Fueling a Ransomware Gang War?<\/title>\n<meta name=\"description\" content=\"As law enforcement disrupts ransomware gangs, experts explain \u2018power abhors a vacuum\u2019 and talk about the rise of the \u201cFive Families\u201d.\" \/>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Are Law Enforcement Crackdowns Fueling a Ransomware Gang War?\" \/>\n<meta property=\"og:description\" content=\"As law enforcement disrupts ransomware gangs, experts explain \u2018power abhors a vacuum\u2019 and talk about the rise of the \u201cFive Families\u201d.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war\" \/>\n<meta property=\"og:site_name\" content=\"Techopedia\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/techopedia\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-17T13:25:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ray Fernandez\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@techopedia\" \/>\n<meta name=\"twitter:site\" content=\"@techopedia\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ray Fernandez\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war\"},\"author\":{\"name\":\"Ray Fernandez\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c\"},\"headline\":\"Are Law Enforcement Crackdowns Fueling a Ransomware Gang War?\",\"datePublished\":\"2024-03-17T13:25:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war\"},\"wordCount\":2048,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg\",\"articleSection\":\"\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#respond\"]}],\"copyrightYear\":\"2024\",\"copyrightHolder\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war\",\"url\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war\",\"name\":\"Are Enforcement Crackdowns Fueling a Ransomware Gang War?\",\"isPartOf\":{\"@id\":\"https:\/\/www.techopedia.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg\",\"datePublished\":\"2024-03-17T13:25:14+00:00\",\"description\":\"As law enforcement disrupts ransomware gangs, experts explain \u2018power abhors a vacuum\u2019 and talk about the rise of the \u201cFive Families\u201d.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#primaryimage\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg\",\"width\":1200,\"height\":600,\"caption\":\"A Cybersecurity Round Table\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.techopedia.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity\",\"item\":\"https:\/\/www.techopedia.com\/topic\/4\/cybersecurity\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Cyber Threats\",\"item\":\"https:\/\/www.techopedia.com\/topic\/220\/cyber-threats\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Are Law Enforcement Crackdowns Fueling a Ransomware Gang War?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.techopedia.com\/#website\",\"url\":\"https:\/\/www.techopedia.com\/\",\"name\":\"Techopedia\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.techopedia.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.techopedia.com\/#organization\",\"name\":\"Techopedia\",\"url\":\"https:\/\/www.techopedia.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg\",\"caption\":\"Techopedia\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/techopedia\/\",\"https:\/\/x.com\/techopedia\",\"https:\/\/www.linkedin.com\/company\/techopedia\/\",\"https:\/\/www.youtube.com\/c\/Techopedia\"],\"publishingPrinciples\":\"https:\/\/www.techopedia.com\/about\/editorial-policy\",\"ownershipFundingInfo\":\"https:\/\/www.techopedia.com\/about\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c\",\"name\":\"Ray Fernandez\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg\",\"caption\":\"Ray Fernandez\"},\"description\":\"Ray is an independent journalist with 15 years of experience, focusing on the intersection of technology with various aspects of life and society. He joined Techopedia in 2023 after publishing in numerous media, including Microsoft, TechRepublic, Moonlock, Hackermoon, VentureBeat, Entrepreneur, and ServerWatch. He holds a degree in Journalism from Oxford Distance Learning and two specializations from FUNIBER in Environmental Science and Oceanography. When Ray is not working, you can find him making music, playing sports, and traveling with his wife and three kids.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/ray-fernandez\/\"],\"knowsAbout\":[\"Senior Technology Journalist\"],\"url\":\"https:\/\/www.techopedia.com\/contributors\/rayfernandez\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Are Enforcement Crackdowns Fueling a Ransomware Gang War?","description":"As law enforcement disrupts ransomware gangs, experts explain \u2018power abhors a vacuum\u2019 and talk about the rise of the \u201cFive Families\u201d.","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"Are Law Enforcement Crackdowns Fueling a Ransomware Gang War?","og_description":"As law enforcement disrupts ransomware gangs, experts explain \u2018power abhors a vacuum\u2019 and talk about the rise of the \u201cFive Families\u201d.","og_url":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war","og_site_name":"Techopedia","article_publisher":"https:\/\/www.facebook.com\/techopedia\/","article_published_time":"2024-03-17T13:25:14+00:00","og_image":[{"width":1200,"height":600,"url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg","type":"image\/jpeg"}],"author":"Ray Fernandez","twitter_card":"summary_large_image","twitter_creator":"@techopedia","twitter_site":"@techopedia","twitter_misc":{"Written by":"Ray Fernandez","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#article","isPartOf":{"@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war"},"author":{"name":"Ray Fernandez","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c"},"headline":"Are Law Enforcement Crackdowns Fueling a Ransomware Gang War?","datePublished":"2024-03-17T13:25:14+00:00","mainEntityOfPage":{"@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war"},"wordCount":2048,"commentCount":0,"publisher":{"@id":"https:\/\/www.techopedia.com\/#organization"},"image":{"@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#primaryimage"},"thumbnailUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg","articleSection":"","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#respond"]}],"copyrightYear":"2024","copyrightHolder":{"@id":"https:\/\/www.techopedia.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war","url":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war","name":"Are Enforcement Crackdowns Fueling a Ransomware Gang War?","isPartOf":{"@id":"https:\/\/www.techopedia.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#primaryimage"},"image":{"@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#primaryimage"},"thumbnailUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg","datePublished":"2024-03-17T13:25:14+00:00","description":"As law enforcement disrupts ransomware gangs, experts explain \u2018power abhors a vacuum\u2019 and talk about the rise of the \u201cFive Families\u201d.","breadcrumb":{"@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#primaryimage","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/Cybersecurity-Round-Table.jpg","width":1200,"height":600,"caption":"A Cybersecurity Round Table"},{"@type":"BreadcrumbList","@id":"https:\/\/www.techopedia.com\/are-law-enforcement-crackdowns-fueling-a-ransomware-gang-war#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.techopedia.com\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity","item":"https:\/\/www.techopedia.com\/topic\/4\/cybersecurity"},{"@type":"ListItem","position":3,"name":"Cyber Threats","item":"https:\/\/www.techopedia.com\/topic\/220\/cyber-threats"},{"@type":"ListItem","position":4,"name":"Are Law Enforcement Crackdowns Fueling a Ransomware Gang War?"}]},{"@type":"WebSite","@id":"https:\/\/www.techopedia.com\/#website","url":"https:\/\/www.techopedia.com\/","name":"Techopedia","description":"","publisher":{"@id":"https:\/\/www.techopedia.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.techopedia.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.techopedia.com\/#organization","name":"Techopedia","url":"https:\/\/www.techopedia.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg","caption":"Techopedia"},"image":{"@id":"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/techopedia\/","https:\/\/x.com\/techopedia","https:\/\/www.linkedin.com\/company\/techopedia\/","https:\/\/www.youtube.com\/c\/Techopedia"],"publishingPrinciples":"https:\/\/www.techopedia.com\/about\/editorial-policy","ownershipFundingInfo":"https:\/\/www.techopedia.com\/about"},{"@type":"Person","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c","name":"Ray Fernandez","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/image\/","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg","caption":"Ray Fernandez"},"description":"Ray is an independent journalist with 15 years of experience, focusing on the intersection of technology with various aspects of life and society. He joined Techopedia in 2023 after publishing in numerous media, including Microsoft, TechRepublic, Moonlock, Hackermoon, VentureBeat, Entrepreneur, and ServerWatch. He holds a degree in Journalism from Oxford Distance Learning and two specializations from FUNIBER in Environmental Science and Oceanography. When Ray is not working, you can find him making music, playing sports, and traveling with his wife and three kids.","sameAs":["https:\/\/www.linkedin.com\/in\/ray-fernandez\/"],"knowsAbout":["Senior Technology Journalist"],"url":"https:\/\/www.techopedia.com\/contributors\/rayfernandez"}]}},"modified_by":"Eddie Wrenn","_links":{"self":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts\/203515","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/users\/286688"}],"replies":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/comments?post=203515"}],"version-history":[{"count":0,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts\/203515\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/media\/203518"}],"wp:attachment":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/media?parent=203515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/categories?post=203515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/tags?post=203515"},{"taxonomy":"category_partsoff","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/category_partsoff?post=203515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}