Close Menu
TechCentralTechCentral

    Subscribe to the newsletter

    Get the best South African technology news and analysis delivered to your e-mail inbox every morning.

    Facebook X (Twitter) YouTube LinkedIn
    WhatsApp Facebook X (Twitter) LinkedIn YouTube
    TechCentralTechCentral
    • News

      Blue Label Telecoms to change its name as restructuring gathers pace

      11 July 2025

      Get your ID delivered like pizza – home affairs’ latest digital shake-up

      11 July 2025

      EFF vows to stop Starlink from launching in South Africa

      11 July 2025

      Apple plans product blitz to reignite growth

      11 July 2025

      Nissan doubles down on South Africa despite plant uncertainty

      11 July 2025
    • World

      Grok 4 arrives with bold claims and fresh controversy

      10 July 2025

      Bitcoin pushes higher into record territory

      10 July 2025

      Cupertino vs Brussels: Apple challenges Big Tech crackdown

      7 July 2025

      Grammarly acquires e-mail start-up Superhuman

      1 July 2025

      Apple considers ditching its own AI in Siri overhaul

      1 July 2025
    • In-depth

      Siemens is battling Big Tech for AI supremacy in factories

      24 June 2025

      The algorithm will sing now: why musicians should be worried about AI

      20 June 2025

      Meta bets $72-billion on AI – and investors love it

      17 June 2025

      MultiChoice may unbundle SuperSport from DStv

      12 June 2025

      Grok promised bias-free chat. Then came the edits

      2 June 2025
    • TCS

      TCS+ | MVNX on the opportunities in South Africa’s booming MVNO market

      11 July 2025

      TCS | Connecting Saffas – Renier Lombard on The Lekker Network

      7 July 2025

      TechCentral Nexus S0E4: Takealot’s big Post Office jobs plan

      4 July 2025

      TCS | Tech, townships and tenacity: Spar’s plan to win with Spar2U

      3 July 2025

      TCS+ | First Distribution on the latest and greatest cloud technologies

      27 June 2025
    • Opinion

      In defence of equity alternatives for BEE

      30 June 2025

      E-commerce in ICT distribution: enabler or disruptor?

      30 June 2025

      South Africa pioneered drone laws a decade ago – now it must catch up

      17 June 2025

      AI and the future of ICT distribution

      16 June 2025

      Singapore soared – why can’t we? Lessons South Africa refuses to learn

      13 June 2025
    • Company Hubs
      • Africa Data Centres
      • AfriGIS
      • Altron Digital Business
      • Altron Document Solutions
      • Altron Group
      • Arctic Wolf
      • AvertITD
      • Braintree
      • CallMiner
      • CambriLearn
      • CYBER1 Solutions
      • Digicloud Africa
      • Digimune
      • Domains.co.za
      • ESET
      • Euphoria Telecom
      • Incredible Business
      • iONLINE
      • Iris Network Systems
      • LSD Open
      • NEC XON
      • Network Platforms
      • Next DLP
      • Ovations
      • Paracon
      • Paratus
      • Q-KON
      • SevenC
      • SkyWire
      • Solid8 Technologies
      • Telit Cinterion
      • Tenable
      • Vertiv
      • Videri Digital
      • Wipro
      • Workday
    • Sections
      • AI and machine learning
      • Banking
      • Broadcasting and Media
      • Cloud services
      • Contact centres and CX
      • Cryptocurrencies
      • Education and skills
      • Electronics and hardware
      • Energy and sustainability
      • Enterprise software
      • Fintech
      • Information security
      • Internet and connectivity
      • Internet of Things
      • Investment
      • IT services
      • Lifestyle
      • Motoring
      • Public sector
      • Retail and e-commerce
      • Science
      • SMEs and start-ups
      • Social media
      • Talent and leadership
      • Telecoms
    • Events
    • Advertise
    TechCentralTechCentral
    Home » In-depth » The 5 most dangerous cybercriminal organisations in the world today

    The 5 most dangerous cybercriminal organisations in the world today

    By The Conversation7 July 2021
    Twitter LinkedIn Facebook WhatsApp Email Telegram Copy Link
    News Alerts
    WhatsApp

    “On the Internet, nobody knows you’re a dog.” These words from Peter Steiner’s famous cartoon could easily be applied to the recent ransomware attack on Florida-based software supplier Kaseya.

    Kaseya provides software services to thousands of clients around the world. It’s estimated between 800 and 1 500 small to medium businesses may be impacted by the attack, with the hackers demanding US$50-million in exchange for restoring access to data being held for ransom.

    The global ransomware attack has been labelled the biggest on record. Russian cybercriminal organisation REvil is the alleged culprit.

    Despite its notoriety, nobody really knows what REvil is, what it’s capable of or why it does what it does

    Despite its notoriety, nobody really knows what REvil is, what it’s capable of or why it does what it does — apart from the immediate benefit of huge sums of money. Also, ransomware attacks often involve vast distributed networks, so it’s not even certain the individuals involved would know each other.

    Ransomware attacks are growing exponentially in size and ransom demand — changing the way we operate online. Understanding who these groups are and what they want is critical to taking them down.

    Here we list the top five most dangerous criminal organisations currently online. As far as we know, these rogue groups aren’t backed or sponsored by any state.

    DarkSide

    DarkSide is the group behind the Colonial Pipeline ransom attack in May, which shut down a major fuel distribution network, triggering concerns about petrol shortages.

    The group seemingly first emerged in August last year. It targets large companies that will suffer from any disruption to their services — a key factor, as they’re then more likely to pay ransom. Such companies are also more likely to have cyber insurance which, for criminals, means easy moneymaking.

    DarkSide’s business model is to offer a ransomware service. In other words, it carries out ransomware attacks on behalf of other, hiding perpetrator/s so they can lessen their liability. The executor and perpetrator then share profits.

    Groups that offer cybercrime-as-a-service also provide online forum communications to support others who may want to improve their cybercrime skills. This might involve teaching someone how to combine distributed denial-of-service (DDoS) and ransomware attacks, to put extra pressure on negotiations. The ransomware would prevent a business from working on past and current orders, while a DDoS attack would block any new orders.

    REvil

    The ransomware-as-a-service group REvil is currently making headlines due to the ongoing Kaseya incident, as well as another recent attack on global meat processing company JBS. This group has been particularly active in 2020 and 2021.

    In April, REvil stole technical data on unreleased Apple products from Quanta Computer, a Taiwanese company that assembles Apple laptops. A ransom of $50-million was demanded to prevent public release of the stolen data. It hasn’t been revealed whether or not this money was paid.

    Clop

    The ransomware Clop was created in 2019 by a financially motivated group responsible for yielding $500-million.
    The Clop group’s speciality is “double extortion”. This involves targeting organisations with ransom money in exchange for a decryption key that will restore the organisation’s access to stolen data. However, targets will then have to pay extra ransom to not have the data released publicly.

    Historical examples reveal that organisations which pay a ransom once are more likely to pay again in the future. So, hackers will tend to target the same organisations again and again, asking for more money each time.

    Syrian Electronic Army

    Far from a typical cybercrime gang, the Syrian Electronic Army has been launching online attacks since 2011 to promote political propaganda. With this motive, they have been dubbed a hactivist group.

    While the group has links with Bashar al-Assad’s regime, it’s more likely made up of online vigilantes trying to be media auxiliary for the Syrian army.

    Their technique is to distribute fake news through reputable sources. In 2013, a single tweet sent by them from the official account of the Associated Press, the world’s leading news agency, had the effect of wiping billions from the stock market.

    The Syrian Electronic Army exploits the fact that most people online tend to interpret and react to content with an implicit sense of trust. And they’re a prime example of how the boundaries between crime and terror groups online are less distinct than in the physical world.

    Fin7

    If this list could contain a “super villain”, it would be Fin7. Another Russian-based group, Fin7 is arguably the most successful online criminal organisation of all time. Operating since 2012, it works mainly as a business.

    Many of its operations have been undetected for years. Its data breaches have exploited cross-attack scenarios, wherein the data breach serves multiple purposes. For example, it may enable extortion through ransom while also allowing the attacker to use data against victims, such as by reselling it to a third party.

    In early 2017, Fin7 was alleged to be behind an attack targeting companies providing filings to the US Security and Exchange Commission. This confidential information was exploited and used to obtain ransom which was then invested on the stock exchange.

    As such, the groups made huge sums of money by trading on confidential information. The insider trading scheme facilitated by hacking went on for many years — which is why it’s not possible to quantify the exact amount of economic damage. But it’s estimated to be well over $1-billion.

    Organised crime vs organised criminals

    When it comes to complex criminal organisations, techniques evolve and motives vary.

    The way they organise themselves and commit crimes online is very different from your local offline gang. Ransomware can be launched from anywhere in the world, so it’s difficult to prosecute these criminals. Matters are made even more complicated when several parties coordinate across borders.

    It’s no wonder the challenge for law enforcement agencies is significant. It’s crucial that authorities investigating an attack are sure it was indeed perpetrated by who they suspect. But to know this, they need all the help they can get.The Conversation

    • Written by Roberto Musotto, research fellow, Brianna O’Shea, lecturer in ethical hacking and defence, and Paul Haskell-Dowland, associate dean (computing and security), all at Edith Cowan University
    • This article is republished from The Conversation under a Creative Commons licence


    Clop Colonial Pipeline DarkSide Fin7 REvil Syrian Electronic Army top
    Subscribe to TechCentral Subscribe to TechCentral
    Share. Facebook Twitter LinkedIn WhatsApp Telegram Email Copy Link
    Previous Article5 reasons this crypto bull market still has a long way to go
    Next Article Trump to sue Zuckerberg, Dorsey after social media ban

    Related Posts

    18GW in unplanned breakdowns cripple Eskom

    2 November 2021

    Nersa kicks the Karpowership can down the road

    13 September 2021

    If you think South African load shedding is bad, try Zimbabwe’s

    13 September 2021
    Company News

    $125-trillion traded: Binance redefines global finance in just eight years

    11 July 2025

    NEC XON welcomes HPE acquisition of Juniper Networks

    11 July 2025

    LTE Cat 1 vs Cat 1 bis – what’s the difference?

    11 July 2025
    Opinion

    In defence of equity alternatives for BEE

    30 June 2025

    E-commerce in ICT distribution: enabler or disruptor?

    30 June 2025

    South Africa pioneered drone laws a decade ago – now it must catch up

    17 June 2025

    Subscribe to Updates

    Get the best South African technology news and analysis delivered to your e-mail inbox every morning.

    © 2009 - 2025 NewsCentral Media

    Type above and press Enter to search. Press Esc to cancel.