PRODAFT Profile picture
Mar 17 6 tweets 3 min read Read on X
🚨 New Report Alert 🚨

For over two years, we’ve lived among cybercriminals, studied their tactics, and uncovered the inner workings of Ruthless Mantis—one of the most structured and dangerous #ransomware groups.

Key findings from our deep-dive investigation: 🧵👇 Image
1️⃣ Ties to #REvil & Notorious Leadership

The leader of Ruthless Mantis, known as "King", was a former #REvil operator arrested in the 2022 Russian crackdown. His deep connections allow the group to collaborate with top-tier ransomware operations.

bbc.com/news/technolog…
2️⃣ Multi-Ransomware Affiliations & High-Profile Attacks

Ruthless Mantis works with #INCRansom, #Qilin, #Nokoyawa, #Snatch, #Medusa, #RansomHouse, #DonutLeaks, and #Lynx.

📌 Example: They were behind the Greater Manchester Police supplier cyberattack.

bbc.co.uk/news/uk-englan…
3️⃣ Not Just a Ransomware Gang—A Criminal Enterprise

Unlike loosely connected ransomware groups, Ruthless Mantis operates like a professional criminal enterprise:

📊 CRM platforms – Track attacks & ransom negotiations
📚 Internal wikis – Train new recruits on tactics
⚖️ Legal consultants – Advise on ransom payments & victim profiling
🕵️ OSINT teams – Gather intelligence on victims for leverage
📞 Call-center scams – Impersonate authorities to pressure victimsImage
4️⃣ One of the Wealthiest Ransomware Groups

💰 Ruthless Mantis isn't just surviving—they're thriving.

Their financial success allows them to buy zero-day vulnerabilities from underground markets, making them even more dangerous.

bleepingcomputer.com/news/security/…
5️⃣ This is a must-read for cybersecurity pros!

We’re releasing our report on Ruthless Mantis' modus operandi, providing key insights for defenders.

Stay ahead—read it now! 🚨

🔗 Report: catalyst.prodaft.com/public/report/…

🔗 IOCs: github.com/prodaft/malwar…

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with PRODAFT

PRODAFT Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @PRODAFT

Dec 22, 2022
🚨 NEW REPORT ALERT

FIN7 UNVEILED: A deep dive into notorious cybercrime gang

The big day is finally here! 🎊After months of tireless research and analyses, we can present you with the most insightful information: an extensive report on the notorious #cybercrime gang #FIN7.
Thanks to the PTI team, we obtained never-seen-before information about FIN7’s inner workings. We got a deeper understanding of their organizational structures, identities, attack vectors, and proof-supported affiliations with other ransomware groups, among others.
The most enticing remarks of the report are:

🔹 Unveiling FIN7’s development of an auto attack system to exploit the most profitable targets based on their revenue, employee count, headquarters’ location, and website information
Read more👇
Read 7 tweets
Dec 21, 2022
🚨New #MicrosoftExchange #vulnerabilities were disclosed, including CVE-2022-41040 and CVE-2022-41082. Threat actors can easily exploit the new vulnerabilities, and bypass #ProxyNotShell URL rewrite mitigations, resulting in many companies facing further #ransomware #attacks.
An example of what such an exploit can do is shown in the picture below, where the #threat actor #FIN7 developed tailored systems to quickly discover and infiltrate the high-value targets by performing mass scans using #Microsoft #exchange #vulnerabilities.
Our PTI team has already observed activities involving recent vulnerabilities in the wild. Therefore, #PRODAFT recommends that companies fix the vulnerabilities as soon as possible to avoid serious consequences.
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(