<\/div>\n

Microsoft said that in Q2 2024, the Octo Tempest cybercrime gang added RansomHub and Qilin ransomware to its arsenal.<\/gwmw><\/gwmw><\/h2>\n\n\n\n

In the second quarter of 2024, financially motivated threat actor Octo Tempest<\/a> (aka\u00a0Scattered Spider<\/a>, UNC3944<\/a>, and 0ktapus<\/a>), added RansomHub<\/a> and Qilin ransomware to its arsenal and used them in its campaigns.<\/p>\n\n\n\n

Octo Tempest has been active since early 2022, it made the headlines with the 0ktapus campaign that is suspected of hacking into hundreds of organizations over the past two years, including Twilio<\/a>, LastPass<\/a>, DoorDash<\/a>, and Mailchimp<\/a>.<\/gwmw><\/p>\n\n\n\n

The Octo Tempest is known for its advanced social engineering, identity compromise, and persistence tactics. The gang frequently targets VMWare ESXi servers and deploys BlackCat ransomware<\/a>. <\/p>\n\n\n\n

RansomHub is a ransomware as a service (RaaS) that was employed in the operations of multiple threat actors. Microsoft reported that RansomHub was observed being deployed in post-compromise activity by the threat actor tracked as Manatee Tempest following initial access by Mustard Tempest via FakeUpdates<\/a>\/Socgholish <\/a>infections.<\/p>\n\n\n\n

\n

In the second quarter of 2024, financially motivated threat actor Octo Tempest, our most closely tracked ransomware threat actor, added RansomHub and Qilin to its ransomware payloads in campaigns. pic.twitter.com\/iS3nnnoxSm<\/a><\/p>— Microsoft Threat Intelligence (@MsftSecIntel) July 15, 2024<\/a><\/blockquote>