Jumpy Pisces, a North Korean state-sponsored threat actor also known as Onyx Sleet, or Andariel, has recently shifted its focus to ransomware attacks, experts have warned.
In a recent technical analysis, researchers from Unit 42 said although Jumpy Pisces had previously focused on cyber-espionage and financial crimes, it has in recent times teamed up with the infamous Play Ransomware group (also known as Fiddling Scorpius).
Play emerged in the summer of 2022, and has since then grown into a formidable threat actor – so much so that in December 2023, the FBI warned about this group, claiming it compromised roughly 300 victims in its first year and a half of its existence.
Initial access brokers
“Since June 2022, the Play (also known as Playcrypt) ransomware group has impacted a wide range of businesses and critical infrastructure in North America, South America, and Europe,” the agency said at the time. “As of October 2023, the FBI was aware of approximately 300 affected entities allegedly exploited by the ransomware actors.”
The role Jumpy Pisces plays in this partnership is not definitively determined, but it’s most likely that it acts as an initial access broker (IAB), opening Play operators doors to different victims.
Unit 42 believes this change is significant because it shows that Jumpy Pisces is getting more involved in ransomware activities, and are using existing ransomware infrastructure instead of building its own. That makes the attacks more sophisticated, and possibly – more widespread.
However, BleepingComputer
In any case, companies should be extra vigilant, the researchers conclude, warning that this new teamup might lead to serious ransomware infections.
More from TechRadar Pro
