- Security scientists discovered a new threat actor called TripleSteste
- The group engages in ransomware, Cloud -Compromis and Kryptomining
- There are potentially hundreds of victims
A small and relatively unknown hacking group has begun to draw attention to themselves by engaging in some unusual “triple threat” cyberattacks.
Researchers from Google recently discovered TriplestroGth, possibly a small threat actor with only a handful of individuals who have been around since 2020, though Google’s researchers have traced it since 2023.
What makes this group stand out is the fact that, besides ransomware, it also hijacks the victim of cloud and uses them to implement cryptominers. The group started with ransomware in 2020 and added crypto-mining part two years later.
Brute Force
For ransomware, Google explains further, the group is mostly targeted at Premier. For cryptomining, it is targeted at Sky Infrastructure from Google Cloud, AWS, Microsoft Azure, Linode and more.
TripleStrength does not appear to be state -supported and instead appears to be motivated by pure profits – looking to get money from both ransom and unauthorized cloud computing.
The first access is mostly performed through brute-force attacks on remote desktop servers or via stolen credentials. When the target endpoints are compromised, TriplestroGth implements malware including Phobos, Locilocker, RCRU64 or Raccoon InfoTeals. For Kryptomining, the group mostly uses us. Interestingly, there was no mention of XMRig, by far the most popular cryptojacker out there.
Talking to RegisteredThe researchers did not want to say exactly how many victims Triple string hit in the last four years, but they emphasized that they “identified several TRX cryptocurrency addresses that we believe are associated with TripleStrength.”
“And at the last count, which is now months out of date, there were over 600 payments to these addresses,” they told the publication. “It gives you at least an idea of the amount of mining that they are likely to perform.”
In other words, there are hundreds of compromised cloud deposits out there, and thus possibly hundreds of ransomware victims.
Via Registered
