Gruyéria Hit by RansomHub Ransomware: Data Exfiltrated
Incident Date:
August 30, 2024
Overview
Title
Gruyéria Hit by RansomHub Ransomware: Data Exfiltrated
Victim
Gruyeria
Attacker
Ransomhub
Location
First Reported
August 30, 2024
RansomHub Ransomware Attack on Gruyéria
Gruyéria, a family-owned business based in Bulle, Switzerland, has recently fallen victim to a ransomware attack orchestrated by the cybercriminal group RansomHub. The attack has resulted in the exfiltration of a significant amount of sensitive data, posing a severe threat to the company's operations and reputation.
About Gruyéria
Established in 1885, Gruyéria specializes in the creation of living spaces through custom furniture and interior design solutions. The company operates a factory in Bulle, where it manages the entire production process, including design, prototyping, and manufacturing. Gruyéria is known for its craftsmanship in manufacturing made-to-measure panels and furniture, catering to both residential and commercial clients. The company employs between 51 and 100 individuals and has a registered capital of CHF 900,000.
Attack Overview
The ransomware attack on Gruyéria was claimed by RansomHub via their dark web leak site. The attackers exfiltrated various file folders and Outlook data files, including an "Administration" folder, a "Dats" folder, a "Projets" folder, and a "Secretariat" folder, all dated 31/2024. Additionally, two substantial Outlook data files were exfiltrated: "Archives_2022.pst" and "EMail pst," with sizes of 948,369 KB and 19,083,865 KB, respectively. This breach has potentially exposed critical business information.
About RansomHub
RansomHub, a Ransomware-as-a-Service (RaaS) group, emerged in February 2024. The group is known for its aggressive affiliate model and double extortion tactics, encrypting victims' data and exfiltrating sensitive information for additional leverage. RansomHub targets high-value sectors such as healthcare, financial services, and government. The group uses advanced techniques, including intermittent encryption and Curve 25519 elliptic curve encryption, to optimize their ransomware's efficiency and impact.
Penetration Methods
RansomHub affiliates primarily use phishing campaigns, vulnerability exploitation, and password spraying to gain initial access. They exploit unpatched systems and zero-day vulnerabilities to infiltrate networks. Once inside, they conduct multi-phase attacks involving network reconnaissance, privilege escalation, and data exfiltration before encrypting files. The group's sophisticated tactics and techniques make them a formidable threat to organizations worldwide.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.