Yanluowang

Yanluowang is a ransomware strain/group active from at least 2021 through late 2022. The content describes it as encrypting victim files and demanding payment, typically in cryptocurrency, while also stealing data and using double-extortion tactics by threatening to publish stolen information on leak sites if victims refused to pay. Reported ransom demands ranged from $300,000 to $15 million. Victims also reported coercive pressure tactics including harassing phone calls and distributed denial-of-service attacks. The group targeted large organizations and multiple U.S. sectors, including banks, telecommunications providers, engineering firms, and other corporate networks, with victims identified across states including Pennsylvania, California, Michigan, Illinois, Georgia, and Ohio. The operation relied in part on initial access brokers, notably Aleksei Olegovich Volkov (alias chubaka.kor), who between July 2021 and November 2022 identified and exploited vulnerabilities, breached corporate networks, and sold access to Yanluowang operators for flat fees and shares of ransom proceeds. Court reporting ties Yanluowang-enabled attacks to at least seven or eight U.S. companies and to more than $9 million in actual losses and over $24 million in intended losses. The content also notes that Symantec first identified the group in October 2021, that it was operational from around August 2021, and that it disbanded in late 2022 after its leak site was hacked and internal chat messages were exposed online. Some reporting cited in the content says the group was thought to be Chinese or was posing as Chinese hackers to obscure its members’ identities.