Threat Intelligence Tarot
Vol. II · 99
Criminal (Russian-speaking, suspected)
★★★★★
risk 3/5
✦ The Neon Predator ✦
Akira
Howling Scorpius
SMBsHealthcareEducationManufacturingCritical infrastructure
Active since March 2023 · Financial extortion, Double extortion
The Neon Predator stalks through the corridors of unpatched VPN infrastructure, its retro aesthetic masking thoroughly modern cruelty. It hunts the small and mid-sized who cannot afford the defense they need.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆250+ victims in first year of operation
- ◆Cisco VPN vulnerability exploitation as primary initial access
- ◆$42M+ ransom collected (FBI 2024 advisory)
- ◆Retro 1980s-styled dark web leak site as brand differentiator
Defenses
- ▸MFA enforcement on all VPN and remote access authenticationNIST CSF: PR.AC ↗
- ▸Timely patching of Cisco and other VPN appliances (within 72 hours of critical CVE)CIS Control 7 ↗
- ▸Endpoint detection covering ransomware behavioral patterns including VSS deletionCIS Control 10 ↗
- ▸Tested backup and recovery procedures with defined RTO and RPOCIS Control 11 ↗
Reversed: Their Weakness
Its overwhelming reliance on VPN credential exploitation means organizations with MFA enforced on all VPN access and timely Cisco patches see dramatic reduction in exposure to this group.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.