2022 saw several significant and historical cases in the ransomware industry, new players were introduced and some already have caused major damage to top-of-the-line organizations around the world. Although LAPSUS$ commenced its operations in December 2021, they have made its greatest impact in 2022, compromising major organizations such as NVIDIA, Vodafone, Samsung Microsoft, LG and Okta.

Within the context of the recent Conti leaks, we have seen the Jabber chats, indicating the size, scope, order, and structure of the Conti group. The subsequent leaks contained screenshots, documents, and the holy-grail – the source code itself.

There is a war going on. We see a twist in the cyber world considering recent events. While some groups take sides, whether in favor of Russia or Ukraine, some groups have gone MIA, and others are completely ignoring and continuing with their usual business model. And then we have Conti, which, as it appears, took the biggest tumble. Conti is one of the most popular ransomware groups of our era.

As we witness history in the making, the scale and complexity of the conflict are immeasurable. When focusing on the cyber warfare aspect of the conflict we can see, first time in history, warfare that includes every type of cyber-personal, state-sponsored groups, ransomware groups, hacktivists, DDoS actors, script kitties and even volunteers that want to join the cause.

First observed in 2021 and advertised as a standalone version on various cybercriminal forums, Mars is an information stealer mainly targeting Windows victim credentials and cryptocurrency wallets including 2FA plugins and any essential system information. Mars is also capable of loading any type of file by downloading and executing them from a given drop-zone. Over the past several months, Mars took the place of a solid info stealer.

AvosLocker is a relatively new ransomware written in C++ that was first seen in June 2021. Their business model is ‘Ransomware-as-a-Service’ (RaaS), and even though they have been operating for less than a year now, they’ve been successful overall when it comes to victims. The group openly and publicly tries to recruit new members to its team and operates a TOR leak site, showcasing the latest victims, as all other ransomware groups do.