ShadowSyndicate Using Server Transition Technique in Ransomware Attacks

ShadowSyndicate, active since 2022, has evolved to rotate SSH keys across reused servers to hinder tracking; researchers identified multiple SSH fingerprints and at least 20 command-and-control servers deploying toolkits like Cobalt Strike, Havoc, Mythic, and others, with infrastructure linked to multiple ransomware groups (Cl0p, ALPHV/BlackCat, Black Basta, Ryuk, Malsmoke). The report provides SSH fingerprints and infrastructure correlation insights and recommends monitoring ASNs, IPs, repeated MFA failures, anomalous login sources, and rapid authentication attempts for detection.