Report Type	Threat Group Profiling
Research Subject	Arvin Club Ransomware Group
TLP	AMBER

Executive Summary

• CloudSEK’s Threat Intelligence Research team analyzed the profile of a ransomware group dubbed Arvin Club.
• This group maintains an Onion site and multiple channels to update their activities and status.
• The group recently breached Kendriya Vidyalaya, a group of central government schools in India. Additionally, the group has shown support for REvil, which has since disbanded.
• Further research was conducted to analyze the group’s operations and TTPs.

 

Preliminary Observations

• Arvin Club is a popular Ransomware group with a widespread Telegram presence, which includes personal group chats, and official channels.
• The group recently launched their official TOR/ Onion website to update their status and release details of their latest attacks and data breaches.
• Their latest target is Kendriya Vidyala, a chain of Schools in India. The group has exposed the Personally Identifiable Information (PII) of some students.

 

Information from the Group’s TOR Website

• The group made their first post on their official TOR website on 5 May 2021. However, it appears that the group has been active prior to that as well.
• The website lists the group’s victims and the date of the breach. However, most of the entities listed were not breached by Arvin Club.
• The breached entities listed on the official Arvin Club TOR website:

 

Breach Date	Victim
24 October 2021	Kendriya Vidyala, India
20 September 2021	Bureau van Dijk
28 June 2021	Leiden University
28 June 2021	Russian Air Carrier UT Air
11 June 2021	Largest password compilation RockYou2021
24 May 2021	Beh Pardakht Mellat Cards
21 May 2021	Iranian educational messenger Etoudplus
15 May 2021	Bank Mellat from Iran
14 May 2021	Card Pay Portal
6 May 2021	USA 280 Million data leak
6 May 2021	Compilation of many breaches (COMB)
4 May 2021	Cybercrime forum Maza
4 May 2021	Underground carding shop titled Swarm Shop
4 May 2021	1.3 Million ClubHouse user records

 

Information from Telegram Channels

• Arvin Club has 2 Telegram channels, one of which is their official channel and has 3000 subscribers.
• The members of the Telegram channels include popular threat actors who have moderate to high reputations across cybercrime forums.
• Persian is a major language of communication across the telegram channels owned by the club.
• Additionally, the group posts about different data breaches which are further published on their website and channels.
• The Telegram group is swamped with discussions, and opinions on different cyber incidents around the world.

 

Research and Analysis

• CloudSEK’s Threat Intelligence Team’s observations suggest that Arvin Club is not a full-fledged ransomware, given the unavailability of samples or dedicated extensions to unlock the files.
• Additionally, there are no mentions of different tools that are specific to the group’s arsenal. This is similar to the modus operandi of the Bonaci group, which does not deploy ransomware to encrypt victims’ files and folders but to exfiltrate and publish data.
• The group seems to incorporate sophisticated hacking methods. However, their recent breach was not impactful and neither did they make any attempts to extort the victim.
• The group has merely tried to make data available publicly and have adopted a Persian motto, which translates to “Freedom to connect.”
• All the above-mentioned features set the Arvin Club apart from typical ransomware groups.

  It should be noted that Arvin Club never claims responsibility for any hacking attempts made on the entities listed on their official website. Owing to which, Threat Intelligence provider Hack Notice explicitly states “as reported by Arvin Club,” and not hacked by them (Refer Appendix).  

Association with the Iranian Government

As a consequence of some hacking incidents, in July 2021 it was reported that the group was allegedly linked to the Iranian government. However, the group has denied these allegations via a post published on their website.    

Response to REvil Event

In response to the REvil ransomware group being rounded-up by the FBI, Arvin Club published a tongue-in-cheek meme on their website.    [caption id="attachment_18177" align="aligncenter" width="381"] Response to members of REvil group being arrested by the FBI[/caption]  

Appendix

  [caption id="attachment_18178" align="aligncenter" width="512"] Arvin Club Ransomware group’s official website[/caption]   [caption id="attachment_18179" align="aligncenter" width="512"] Hack Notice’s post mentioning Arvin Club[/caption]