OldGremlin Ransomware: Never Ever Feed Them after The Locknight

In March 2020, Group-IB analysts discovered a ransomware group that they named OldGremlin. Only Russian organizations, supposedly using this market as a testing ground before expanding to other geographies.

For each new campaign, the “gremlins” adjust the kill chain, exploit well-known brands, and carefully prepare the emails and documents to deceive their victims. Read about the group’s attack history and the tactics and techniques that it uses.