Morpheus Unmasked: Big Game Hunting And Private Data Sales

Ankura CTIX

Recent Ankura cases dealing with Morpheus ransomware group suggest that a new approach to the ransomware ecosystem is gaining popularity among threat actors. Typically, when a ransom is not paid, the threat actor resorts to leaking the victim’s data. In these situations, Ankura’s Cyber Threat Investigation & Expert Services (CTIX) analysts navigate the dark web and conduct covert downloads to determine exactly what data has been publicly leaked and exposed on the threat actor’s dark web leak site. Although tactics vary slightly, the standard procedure among most ransomware groups that do not receive a ransom payment is to post the victim’s stolen data for free. This is intended to pressure and incentivize future victims into paying. However, the Ankura CTIX team has observed that Morpheus is diverging from this operating model and instead taking a private-sales approach, rather than following the typical public data-leak blueprint.