Cicada 3301 Ransomware Breach at Crown Mortgage Company
Incident Date:
September 24, 2024
Overview
Title
Cicada 3301 Ransomware Breach at Crown Mortgage Company
Victim
Crown Mortgage Company
Attacker
Cicada 3301
Location
First Reported
September 24, 2024
Cicada 3301 Ransomware Attack on Crown Mortgage Company
Crown Mortgage Company, a prominent mortgage lender based in Oak Lawn, Illinois, has recently fallen victim to a ransomware attack orchestrated by the notorious group Cicada 3301. This attack has resulted in the exfiltration of 103 GB of sensitive data, raising significant concerns about data security within the financial sector.
About Crown Mortgage Company
Established in 1975, Crown Mortgage Company has been a key player in the Chicagoland mortgage market, offering a range of loan products including conventional, FHA, and VA loans. Known for its personalized service and local approach, the company has built a strong reputation for customer satisfaction, with a high referral rate from satisfied clients. Despite its success, Crown Mortgage's classification as a small to mid-sized business may have made it an attractive target for cybercriminals, who often exploit the relatively weaker cybersecurity defenses of such organizations.
Attack Overview
The ransomware group Cicada 3301, known for its focus on data exfiltration and sale rather than traditional ransom demands, has claimed responsibility for the attack on Crown Mortgage. The group operates using a double-extortion model, threatening to release stolen data if their demands are not met. This approach underscores the importance of effective cybersecurity measures, particularly for companies handling sensitive financial data.
About Cicada 3301
Cicada 3301 distinguishes itself from other ransomware groups by prioritizing data brokerage over immediate ransom payments. Operating as a Ransomware-as-a-Service (RaaS) group, they have been linked to the Repellent Scorpius group and are known to use the Brutus botnet for initial network access. Their sophisticated tactics include exploiting vulnerabilities in VPN environments and employing advanced encryption techniques to maximize disruption.
Potential Vulnerabilities
The attack on Crown Mortgage highlights potential vulnerabilities in the company's cybersecurity infrastructure. Cicada 3301 likely gained access through phishing campaigns or by exploiting weaknesses in VPN credentials. The group's use of tools like PsExec for lateral movement and RClone for data exfiltration further emphasizes the need for comprehensive security protocols to protect against such sophisticated threats.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.