Quote:A new type of cybercriminal is emerging in a cyber-threat landscape that’s historically been dominated by either state-sponsored threat actors or financially-motivated criminals that are hunted and prosecuted by law enforcement.
 
Dubbed “privateers” by researchers at Cisco Talos Intelligence, these predominantly ransomware groups are not specifically sponsored and directed by a government—such as APT groups like North Korea’s Lazarus and Russia’s Fancy Bear. However, they do have some type of protection from global governments while they themselves remain financially motivated and act upon their own agendas.
 
“That type of unofficial state protection frequently manifests as a lack of law enforcement action, even when requested through normal channels by other countries,” according to a post on the Cisco Talos Intelligence blog post published Wednesday. “The protecting state doesn’t receive direct benefit from these groups, but it is shielded from their activities, which frequently target the geopolitical adversaries of the protecting state.”

Indeed, while privateer cybercriminal groups are not specifically state-sponsored, they may carry out activities of the protecting state anyway due to pressure to engage in specific actions or target specific entities, according to the post.

Privateers fall in the third tier of cybercrime groups below those specifically sponsored by governments at the top, commonly known as APTs and which receive explicit direction and financial support by a nation-state.

Below these top-tier actors are those that are believed to be working for nation-states but not actively sponsored by them, such as Ukraine’s Gamaredon as well as Promethium, also known as Strong Pity, researchers said.