Threat actor
threat_actor:ransom_man
Pseudonym used by the attacker who claimed responsibility for compromising Vastaamo and extorted the company and its patients.
Pseudonym used by the attacker who claimed responsibility for compromising Vastaamo and extorted the company and its patients.
“they were calling themselves Ransom Man”
“Ransom Man said, I have been trying to get 400,000 euros”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Torilauta | Explicit | 159 |
| outgoing | USES | Ylilauta | Explicit | 159 |
| incoming | ATTRIBUTED_TO | Vastaamo cyber attack | Attributed | 159 |
| incoming | INVOLVES | Vastaamo cyber attack | Explicit | 159 |
| incoming | POSSIBLY_SAME_AS | Julius Kivimaki | Uncertain | 159 |
Vastaamo cyber attack ATTRIBUTED_TO Ransom Man
The attack was initially attributed through Ransom Man's own claim that he had hacked Vastaamo and possessed its clients' data.
Attributed Confidence 98% · Joe Tidy EP 159 Details
“they were calling themselves Ransom Man and they were saying, I have hacked the Vastaamo psychotherapy center”
Vastaamo cyber attack INVOLVES Ransom Man
Ransom Man is the actor who communicated the ransom demands and disclosed patient records in the incident.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“Ransom Man said, I have been trying to get 400,000 euros”
Ransom Man USES Torilauta
Ransom Man used Torilauta to announce the Vastaamo compromise, threaten publication, and publish records.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“he posted it on the darknet on a website which is now gone, but it was called Torilauta”
Ransom Man USES Ylilauta
Ransom Man also posted the stolen records and threats on the clearweb forum Ylilauta.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“As well as posting on Torilauta, he posted it to a clearweb forum called Ylilauta”
Julius Kivimaki POSSIBLY_SAME_AS Ransom Man
The episode presents the possibility that Ransom Man was Julius Kivimaki, supported by speculation and investigative evidence, but does not treat the identity as certain at that point.
Uncertain Confidence 90% · Jack Rhysider EP 159 Details
“Could Ransom Man be him? Speculators were thinking it, but the investigator, Marko, was finding actual evidence that was pointing to him”