Russian Ransomware Groups Deploy Email Bombing and Teams Vishing

Security experts at Sophos have warned that two ransomware groups it is tracking as STAC5143 and STAC5777 are attempting to trick corporate victims into providing remote access to their machines, for data exfiltration and possible extortion.

STAC5777 shares characteristics of Storm-1811 – a financially motivated cybercrime group known to deploy Black Basta ransomware. STAC5143 is a “previously unreported threat cluster” with possible links to prolific threat actors FIN7.

Using email bombing and Teams-based social engineering, the two groups attempt to gain remote access to corporate systems, with an end goal of data theft and extortion. At least 15 attacks have been noted since November 2024, with at least half of these coming in the past two weeks.?

Read more here.