The strange link between Industrial Spy and the Cuba ransomware operation

The recently launched Industrial Spy data extortion marketplace has now started its ransomware operation.

In April, Malware HunterTeam and Bleeping Computer reported the launch of a new dark web marketplace called Industrial Spy that sells stolen data and offers free stolen data to its members. MalwareHunterTeam researchers spotted malware samples [12] that drop the following wallpaper that promotes the site.

Here is the wallpaper that gets dropped on systems where one of their samples run.
Same typos/mistakes as in the text notes seen, and also the whole text is repeated.
Very strange…
🤔 pic.twitter.com/on0v3IryKB

— MalwareHunterTeam (@malwrhunterteam) April 15, 2022

Upon executing the malware it creates README.txt files in every folder on the machine, the content of the files includes a description of the service and a link to the Tor site.

Below is the description for the marketplace:

“There you can buy or download for free private and compromising data of your competitors. We public schemes, drawings, technologies, political and military secrets, accounting reports and clients databases. All this things were gathered from the largest worldwide companies, conglomerates and concerns with every activity. We gather data using vunlerability in their IT infrastructure. in their IT infrastructure. Industrial spy team processes huge massives every day to devide you results. You can fid it in their portal:

Industrial Spy is a marketplace that offers businesses data on their competitors, including intellectual property and trade secrets.

The marketplace has different levels of data offerings, from $2 for individual files up to “premium” stolen data related which

Read more

Explore the site

More from the blog

Latest News