The Underground ransomware is the successor of the Industrial Spy ransomware and was deployed by a threat actor called Storm-0978.