Triplestrength hits with ransomware, cloud crypto mining

A previously unknown gang dubbed Triplestrength poses a triple threat to organizations: It infects victims' computers with ransomware, and also hijacks their cloud accounts to illegally mine for cryptocurrency. Google's threat intelligence group has been tracking Triplestrength since 2023, and only recently started talking about this financially motivated criminal crew. It's a small-ish group, "probably focused around a handful of individuals," Genevieve Stark, head of cybercrime, hacktivism, and information operations intelligence analysis for the Google Threat Intelligence Group, told The Register. But, despite lacking in numbers, the gang is very active in hacking and cybercrime forums, and the cloud giant's incident responders have seen online personas connected to Triplestrength advertise access to compromised servers, including those in Google Cloud, Amazon Web Services, Microsoft Azure, Linode, OVHCloud, and Digital Ocean, and recruiting other criminals for its extortion work. On the ransomware front, it appears that the gang's members have carried out attacks since at least 2020, "based on the activity we've seen in underground forums," Stark said. These ransomware infections target on-premises systems only — not cloud infrastructure — and unlike most modern ransomware criminals, they don't involve double-extortion. This is where the thieves first steal victims' files, then encrypt the stolen data, and threaten to leak or sell it if the victim doesn't pay a ransom dem...