Some lower-tier ransomware gangs have formed a new RaaS alliance — or have they?

The piece reports that the Stormous group announced in its fifth edition (V5) a strategic alliance supposedly uniting six RaaS groups, along with their extended networks, affiliated personnel, malware toolkits and operational infrastructure, with aims to expand attack surfaces, enhance lateral movement and optimise ransomware campaigns.

The groups named are Nova Ransomware, DevMan Ransomware, CoinBase Cartel, RADAR Ransomware, Desolator Ransomware and Kryptos Ransomware, though the author notes that the alliance would amount to seven groups if Stormous counts itself. A check of five of the six other entities’ sites found no statements about any new alliance or cartel, and one site was offline and could not be checked.

The piece questions whether the members truly recognise themselves as forming a cartel or alliance, and suggests possible uncertainty about confirmation from the other entities in the days ahead. According to SuspectFile, the report raises questions about the reliability of the announcement. The overall takeaway is that while the alliance claim is circulating, corroboration from the named groups remains thin.