Stykas, a security researcher and chief technology officer at Atropos.ai, conducted a research project aimed at identifying the command and control servers behind more than 100 ransomware and extortion-focused groups and their data leak sites. His goal was to find vulnerabilities that could expose information about these gangs, including details about their victims. Stykas disclosed his findings to TechCrunch ahead of his presentation at the Black Hat security conference in Las Vegas. He identified several rookie security flaws in the web dashboards used by at least three ransomware gangs, which were sufficient to compromise the inner workings of their operations.
Ransomware gangs typically conceal their identities and activities on the dark web, an anonymous section of the internet accessible through the Tor browser. This anonymity makes it difficult to trace the real-world servers used for cyberattacks and the storage of stolen data. However, coding errors and security vulnerabilities in the leak sites used by these gangs to extort victims by publishing stolen files allowed Stykas to access information about their operations without needing to log in. In some cases, the bugs exposed the IP addresses of the leak site’s servers, providing a way to trace their real-world locations.
For instance, Stykas discovered that the Everest ransomware gang was using a default password to access its back-end SQL databases, exposing its file directories.
Additionally, exposed API endpoints revealed the targets of the BlackCat ransomware gang’s attacks while they were still in progress. Stykas also identified an insecure direct object reference (IDOR) vulnerability, which he used to access and cycle through the chat messages of a Mallox ransomware administrator. Through this, he discovered two decryption keys that he shared with the affected companies.
The researcher informed TechCrunch that the victims included two small businesses and four cryptocurrency companies, two of which were unicorns—startups with valuations exceeding $1 billion. However, he declined to name the companies involved. He also noted that none of the companies he notified have publicly disclosed the security incidents, though he did not rule out revealing their names in the future.
The FBI and other government authorities have long advised victims of ransomware not to pay ransoms, as doing so only incentivizes cybercriminals. However, this advice often leaves companies with few options to regain access to their data or resume operations. Law enforcement agencies have occasionally succeeded in compromising ransomware gangs to obtain decryption keys and cut off their illegal revenue streams, though these efforts have had mixed results.
Stykas’ research underscores that ransomware gangs can be vulnerable to the same basic security flaws that affect large companies. This presents a potential opportunity for law enforcement to target these criminal hackers, even when they operate outside of traditional jurisdictional reach.
