Groove

Groove was publicly described in 2021 as a new ransomware affiliate program and extortion group announced on the Russian-language cybercrime forum RAMP by the administrator "Orange." It was presented as an aggressive, financially motivated criminal organization involved in industrial espionage, and it called on other extortion gangs to unite in attacking U.S. government interests online. Groove operated a darknet victim-shaming blog and, in early September 2021, posted roughly 500,000 Fortinet VPN credentials taken from systems that had not applied a May 2019 patch. Reporting assessed that this credential dump may have been intended to attract affiliates or attention.

However, later reporting indicated Groove may have been largely or entirely a hoax or failed operation. The actor "Boriselcin" claimed on the XSS forum that he created Groove as a fake gang, used old Fortinet credentials, and deliberately manipulated journalists and security firms. Intel471 assessed that a single actor likely operated both the Groove blog and the RAMP forum, and that Groove may have been less a pure hoax than an unsuccessful attempt to create a ransomware group. Throughout its existence, Groove listed only a small number of victims, and its blog later disappeared.

Supporting reporting linked Groove to the RAMP ecosystem and to personas associated with Babuk. McAfee assessed with high confidence that Groove was a former affiliate or subgroup of Babuk and likely affiliated with BlackMatter. Separate reporting tied the aliases "Orange" and "Boriselcin" to Russian national Mikhail Pavlovich Matveev, also known as Wazawaka, and identified Orange as the founder of RAMP. Known associated aliases and personas mentioned in the reporting include Orange and Boriselcin; broader linked identities in the same reporting include Wazawaka, TetyaSluha, and Uhodiransomwar.