New Ransomware Threat Group Calls Attack Victims to Ensure Payments

Researchers identified a new ransomware operator called Volcano Demon that follows typical intrusion steps—harvesting admin credentials, exfiltrating data to a C2, clearing logs, and encrypting data with LukaLocker—but diverges in its extortion phase by calling leadership and IT executives directly and frequently to negotiate ransom payments, which may increase likelihood of payment; the report recommends layered email defenses and security awareness training.