A Nigerian attacker has been seen attempting to recruit employees by offering them to pay $1 million in bitcoins to setup Black Kingdom ransomware on an organization’s networks as part of an insider threat scheme.

“The sender tells the employee that if they are able to setup ransomware on an organization computer or Windows server, then they would be paid $1 million in bitcoin, or 40% of the presumed $2.5 million of ransom.” “The insiders is told they can setup the ransomware physically or remotely. The sender provided two ways to connect them if the insider is interested—an Outlook email account and a Telegram username.”    

The Black Kingdom, also known as DemonWare and DEMON, is in the limelight earlier this March when the attackers were discovered harming ProxyLogon bugs impacting Microsoft Exchange Servers to harm unpatched systems with the ransomware injure.

Security researchers, which analyze and blocked the phishing emails on August 12 reverted to the solicitation attempt by generating an apocryphal persona and reached out to the threat actor on Telegram messenger, only to have the individual inadvertently spill the attack’s modus operation, which consists of two distinct links for an executable ransomware payload that the “employee” could download.

How do threat actors Manipulate the Insiders?

“The threat actor also suggested us to dispose of the .EXE file and delete it from the recycle bin. Based on the threat actor’s revert, it looks clear that he might expects an insider to have physical access to a server or he’s not well-known with digital forensics or incident response researches.”    

Besides taking a malleable approach to their ransom demands, the plan is believed to have been contriving by the chief executive of a Logas-based social networking startup called Sociogram, to use the siphoned funds to “establish my own company.” In one of the discussions that took place over around five days, the individual even took to calling himself “the next Mark Zuckerberg.”

How do they Collect Insiders Information?

Also of particular note is the method of using LinkedIn to collect corporate email addresses of senior-level executives, once again highlighting how business email compromise (BEC) attacks originating from Nigeria continue to evolve and expose businesses to sophisticated attacks like ransomware.

“There’s always been a blurry line between cyberattacks and social engineering, and this is an example of how the two are connected. As almost people become better at recognizing and avoiding phishing, it should be no surprise to see attackers adopt new tactics to accomplish their goals,” Tim Erlin, vice president of product management and strategy at Tripwire, said.

“The concept of a disgruntled insider as a cybersecurity threat isn’t new. As long as organizations require employees, there will always be some insider risk. The promise of getting a share of the ransom might seem attractive, but there’s almost zero guarantee that this kind of complicity will actually be rewarded, and it’s notably likely that someone taking this attacker up on their proposal would get taken,” researchers added.