Unmasking the Cybercriminal Behind ALTDOS, DESORDEN, GHOSTR, and Omid16B

To communicate demands, the threat actor left ransom notes or sent emails detailing exfiltrated databases and payment methods. In some cases, the actor would even directly threaten the victim’s customers.