Unlike many ransomware attack groups, Octo Tempest does not encrypt data that is illegally accessed. Instead, the attacker threatens to make the data public unless the victim pays a significant ransom.
The group uses a variety of methods to bypass victims’ defenses, including social engineering, SIM swapping, SMS phishing and calls. The group has become increasingly aggressive over time, sometimes resorting to threats of physical harm if demands to hand over identifying information are not met.
In a recent Microsoft blog post, researchers write that Octo Tempest has been seen targeting specific individuals through phone calls and text messages, using personal information such as home addresses and last names to trick victims into sharing their corporate access credentials.
The group first emerged early last year when it used SIM card swapping to take over companies that provided mobile data processing services to other companies. The group sold the unauthorized access gained as a result of swapping SIM cards to other criminal groups or used it to hijack wealthy people’s accounts and steal cryptocurrencies.
By the end of the year, the group expanded its methods to include cable broadcasting, e-mail and technology organizations among its targets. Around this time, he began extorting money from victims whose data had been stolen, sometimes resorting to threats of physical harm.
There have also been cases where Octo Tempest pretended to be newly hired employees in order to comply with the normal hiring process.
Source: Ferra
I am a professional journalist and content creator with extensive experience writing for news websites. I currently work as an author at Gadget Onus, where I specialize in covering hot news topics. My written pieces have been published on some of the biggest media outlets around the world, including The Guardian and BBC News.
