Mandiant cybersecurity experts: The APT (aka UNC2452) also shows two distinct clusters of activity, UNC3004 and UNC2652.
The pro-Turkish militias finance themselves with the spurious arrests of civilians. The accusation in all cases is false links with the Kurdish administration and the release of the prisoners takes place after the payment of a ransom
The new ploy of the pro-Turkish militias in northern Syria to raise cash are the spurious arrests of civilians for ransom. The common denominator is accusations of having had links with the Kurdish autonomous administration. The latest episode took place a few days ago and saw an al-Sham Corps patrol capture a young man in the district of Jendires (Afrin). Shortly before, the same fate had befallen a woman in Sharran (Aleppo). In that case, the accused was not her but her son. However, this did not stop the guerrillas from arresting her and asking for money to free her. The amount requested is in all cases between 3,000 and 5,000 dollars. The victims, however, all come from wealthy families, able to find the necessary money. This is just the latest system that the TAF allied militias use to raise funds, after Ankara cut their aid.