Wagner ransomware wants to recruit its victims
Wagner ransomware infects user devices and invites them to join the Wagner Group, a Russian private military corporation (PMC) that recently attempted a march on Moscow.
Image by Cybernews.
Wagner ransomware infects user devices and invites them to join the Wagner Group, a Russian private military corporation (PMC) that recently attempted a march on Moscow.
The recently detected ransomware likely targets Russians, and instead of asking for money, demands victims join the ranks of the PMC headed by Yevgeny Prigozhin, researchers at Cyble claim.
“Official Wagner PMCs employment virus,” the ransom note deployed on victim devices says in Russian.
The note also calls to “wage war” against Russia’s longtime Minister of Defence Sergei Shoigu. The demands echo recent events in Russia, with Prigozhin openly badmouthing Shoigu over Moscow’s incompetence in waging war against Ukraine.
According to Cyble, while the ransom note mimics the bio section of the Wagner Group Telegram channel, the PMC itself did not come out publicly to say the ransomware campaign is of its making.
“The Wagner group has not officially stated its involvement in this ransomware. Therefore, the individuals responsible for this particular strain remain unknown,” Cyble’s researchers said.
The strain appears to be a variant of Chaos ransomware, which evolved from the infamous RYUK ransomware strain.
Wagner ransomware targets victims’ data stored on the C: drive, encrypting everything from links and contacts to OneDrive and documents. After encryption, all files are renamed with the “.Wagner” extension.
PMC Wagner is funded by the Russian government and was established around 2014. While Prigozhin deals with the business and policy side of the business, Dmitry Utkin, a former Russian military intelligence officer, takes care of the military side.
The group has been instrumental in Russia’s military efforts in Central Africa and Ukraine since 2014, rising to prominence after the Kremlin launched a full-scale war against the country in February 2022.
While the true origins of the PMCs name are largely a mystery, reports link it with German composer Richard Wagner, a favorite of Adolf Hitler. Utkin himself is no stranger to neo-Nazi ideology, having several tattoos glorifying the Third Reich.