Underground Ransomware Gang Unleashes Innovative Tactics Targeting Global Organizations

The Underground ransomware gang has been coordinating recurring attacks on enterprises worldwide, with its operations spanning sectors such as construction, manufacturing, IT and interior design and affecting organisations in the United States, United Arab Emirates, France, Spain, Australia, Germany, Slovakia, Taiwan, Singapore, Canada and South Korea.

First detected in July 2023, the group resurfaced in May 2024 with a revamped Dedicated Leak Site exposing exfiltrated data from victims that refuse to pay, and its victims include organisations with annual revenues ranging from $20 million to $650 million.

The malware uses a hybrid cryptographic scheme combining RNG, AES and RSA, encrypting each file with a unique AES key, appending RSA-encrypted key metadata, and employing a selective encryption approach that targets high-value data segments, with small files fully encrypted and larger ones processed in stripes to optimise performance, according to ASEC report.

Before encryption, the malware performs a parameter check, creates a mutex to prevent multiple instances (8DC1F7B9D2F4EA58), deletes Volume Shadow Copies, and blocks remote desktop connections, while excluding critical OS paths and essential file extensions. Post-encryption, it erases traces with an erasor.bat script and presents a ransom note with victim-specific details and a Tor-based negotiation portal.

These sophisticated techniques reflect a broader trend in ransomware, underscoring the importance of robust backups, strict access controls and proactive threat intelligence to counter evolving campaigns.