Behind the Scenes of Matveev's Ransomware Empire: Tactics and Team

PRODAFT attributes a widespread Russian ransomware operation to Mikhail "Wazawaka" Matveev and a six-person team, linking them to development and deployment of LockBit, Babuk, Hive and related operations since 2020; the analysis details their use of OSINT and scanning services, initial access brokers, brute-force and privilege escalation techniques, frequent abuse of MeshCentral RMM, and associations with known cybercriminals including Evil Corp and Evgeniy Bogachev.