The previously unknown DarkBit gang appeared only this week, and its location is unknown. However, the attackers gave some indicators about their intentions in the ransom note and on their Telegram and Twitter channels. At first look, DarkBit’s operations appear to be hacktivism because of their opposition to “racism, fascism, and apartheid,” but the group’s goals are more complex. Hackers seek to hold Israel accountable for “war crimes against humanity” and “firing high-skilled experts” while denouncing it as an “apartheid regime”. “A kindly advice to the hight-tech companies: From now on, be more careful when you decide to fire your employees, specially the geek ones [sic],” DarkBit said in a subsequent tweet. It appears that DarkBit launched the attack as revenge for potential member layoffs. Threat actors imply that firing highly technical staff members without due diligence can jeopardize an organization’s security position. Some fired workers may have insider information that may allow them to gain easier access to an organization’s network.
https://www.bleepingcomputer.com/news/security/ransomware-hits-technion-university-to-protest-tech-layoffs-and-israel/
