The Dark Visitor

Another great post over at Dancho’s on who is behind the GPcode Ransomware.  Probably just an available proxy in Liaoning but worth keeping an eye to see if these groups eventually start working together:

The John Dow-ish Daniel Robertson is emailing from 58.38.8.211 (Liaoning Province Network China Network Communications Group Corporation No.156,Fu-Xing-Men-Nei Street, Beijing 100031), and Paul Dyke from 221.201.2.227(Liaoning Province Network China Network Communications Group Corporation No.156,Fu-Xing-Men-Nei Street, Beijing 100031), both Chinese IPs, despite that these campaigners are Russians.

Of course read the rest of this article but check out his other posts…fantastic!

Hat-Tip: As always, Jumper

    Interesting article from SCmagazine on Chinese hackers filling the void after the Russian hackers packed up shop.  It doesn’t give enough detail to determine the particulars but raises a lot of questions.  Was this a voluntary surrender by the Russians?  Working in concert with one another?  Would love to hear more about it if anyone knows. 

Russian Hacker Move Out…And The Chinese Move in.