OldGremlin Ransomware: Never Ever Feed Them after The Locknight
← Research Hub

OldGremlin Ransomware: Never Ever Feed Them after The Locknight

The case of OldGremlin illustrates how the ransomware industry has evolved in recent years. In this report, you will find the history of the “gremlins”, descriptions of the tactics and tools they use, and recommendations on how to secure your organization from these threat actors.

In this report:

TTPs

Discover the group’s tools as well as the tactics, techniques and procedures that they use, mapped to MITRE ATT&CK® matrix

Kill Chain

Explore the history of OldGremlin’s campaigns and the full attack cycle based on unique data from Group-IB Threat Intelligence

IoCs and recommendations

Learn the indicators of compromise and recommendations on how to protect against OldGremlin attacks

Why OldGremlin is dangerous

In March 2020, Group-IB analysts discovered a ransomware group that they named OldGremlin. Only Russian organizations, supposedly using this market as a testing ground before expanding to other geographies.

For each new campaign, the “gremlins” adjust the kill chain, exploit well-known brands, and carefully prepare the emails and documents to deceive their victims. Read about the group’s attack history and the tactics and techniques that it uses.

About OldGremlin

Attack geography:Attack geography:

Russia

Key targeted sectors:Key targeted sectors:

Manufacturing, logistics, insurance, retail, real estate, software development

Total number of attacks:Total number of attacks:

16

Dwell time in the victim’s infrastructureDwell time in the victim’s infrastructure

49 days

Highest ransom demand:Highest ransom demand:

$16.9 million

Advanced protection against cyber threats

Group-IB’s security ecosystem provides comprehensive protection for your IT infrastructure based on our unique cyber intelligence and deep analysis of attacks and incident response.