hiveleak attacks PHC

Incident Date:

March 29, 2022

World map

Overview

Title

hiveleak attacks PHC

Victim

PHC

Attacker

Hiveleak

Location

Lahore, Pakistan

Punjab, Pakistan

First Reported

March 29, 2022

Hive Ransomware Attack on PHC

The Hive ransomware group has claimed responsibility for an attack on the Pakistan Healthcare Company (PHC), a government sector organization, through their dark web leak site. The victim's website is https://newsite.phc.org.pk/#/home. The attack is part of a wider campaign by Hive, which has targeted over 1,500 victims worldwide, including healthcare providers and critical infrastructure sectors.

Victim Profile

PHC is a government sector organization, but specific details about the size of the company, its unique features, and vulnerabilities are not readily available from the search results. However, it is known that Hive ransomware attacks have targeted a wide range of businesses and critical infrastructure sectors, including healthcare and public health.

Hive Ransomware

Hive ransomware is a human-operated ransomware that uses a double-extortion model, where the attackers exfiltrate sensitive data before encrypting the victim's system. They then demand a ransom for both the decryption key and a promise not to publish the stolen data. Hive ransomware is written in Go and uses concurrency features to encrypt files faster.

Mitigation Strategies

To mitigate the risk of ransomware attacks, organizations should prioritize remediating known exploited vulnerabilities, enable and enforce multifactor authentication with strong passwords, and close unused ports and remove any application not deemed necessary for day-to-day operations.

The Hive ransomware attack on PHC is part of a larger campaign by the group, which has targeted over 1,500 victims worldwide. While specific details about the victim are not available, it is known that Hive ransomware has targeted a wide range of businesses and critical infrastructure sectors, including healthcare and public health. Organizations should take steps to mitigate the risk of ransomware attacks, such as prioritizing the remediation of known vulnerabilities and implementing strong security practices.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.