Just Evil is a pro-Russian cyber threat group formed in January 2024 by KillMilk. This group emerged following internal changes within KillNet.

8Base emerged in March 2022, and their activity spiked in June 2023 after they started attacking companies across a broader range of industry verticals and switching to double extortion. The gang launched its data leak site in May 2023, with the extortion group claiming to be “honest and simple” pen testers targeting “companies that have neglected the privacy and importance of the data of their employees and customers.”

As of Jun ’23 the ransomware group has listed over 350 victims on its site, announcing up to six victims at once on some days. 8Base uses a customized version of Phobos ransomware, a malware that first surfaced in 2019 and shares many code similarities with Dharma ransomware.

Embargo is a ransomware operation known for using Rust-based malware and operating under a ransomware-as-a-service (Raas) model. Like many modern ransomware groups, Embargo employs double extortion tactics where they first exfiltrate sensitive data from their victims before encrypting their files. They then threaten to release the stolen data unless a ransom Is paid.

The group was first observed by researchers early 2024. Embargo has claimed attacks on multiple hospitals.

Hackers of Ukraine’s military intelligence agency (HUR)

RansomHub ransomware-as-a-service believe that it has evolved from the currently defunct Knight ransomware project.

RansomHub has a short history and operated mainly as a data theft and extortion group that sells stolen files to the highest bidder. The gang grabbed attention in mid-April when it leaked stolen data from United Health subsidiary Change Healthcare following a BlackCat/ALPHV attack, suggesting some form of collaboration between the two.

Knight ransomware launched in late July 2023 as a re-brand of the Cyclops operation and started breaching Windows, macOS, Linux/ESXi machines to steal data and demand a ransom. One of the peculiarities of Knight was that it also offered affiliates an info-stealer component that could make the attacks more impactful.

In February 2024, the source code for version 3.0 of Knight ransomware put up for sale on hacker forums, the victims extortion portal went offline, and the RaaS operation went silent.