hiveleak attacks PHC
Incident Date:
March 29, 2022
Overview
Title
hiveleak attacks PHC
Victim
PHC
Attacker
Hiveleak
Location
First Reported
March 29, 2022
Hive Ransomware Attack on PHC
The Hive ransomware group has claimed responsibility for an attack on the Pakistan Healthcare Company (PHC), a government sector organization, through their dark web leak site. The victim's website is https://newsite.phc.org.pk/#/home. The attack is part of a wider campaign by Hive, which has targeted over 1,500 victims worldwide, including healthcare providers and critical infrastructure sectors.
Victim Profile
PHC is a government sector organization, but specific details about the size of the company, its unique features, and vulnerabilities are not readily available from the search results. However, it is known that Hive ransomware attacks have targeted a wide range of businesses and critical infrastructure sectors, including healthcare and public health.
Hive Ransomware
Hive ransomware is a human-operated ransomware that uses a double-extortion model, where the attackers exfiltrate sensitive data before encrypting the victim's system. They then demand a ransom for both the decryption key and a promise not to publish the stolen data. Hive ransomware is written in Go and uses concurrency features to encrypt files faster.
Mitigation Strategies
To mitigate the risk of ransomware attacks, organizations should prioritize remediating known exploited vulnerabilities, enable and enforce multifactor authentication with strong passwords, and close unused ports and remove any application not deemed necessary for day-to-day operations.
The Hive ransomware attack on PHC is part of a larger campaign by the group, which has targeted over 1,500 victims worldwide. While specific details about the victim are not available, it is known that Hive ransomware has targeted a wide range of businesses and critical infrastructure sectors, including healthcare and public health. Organizations should take steps to mitigate the risk of ransomware attacks, such as prioritizing the remediation of known vulnerabilities and implementing strong security practices.
Sources
- "Understanding Ransomware and Strategies for Prevention and Response" - Cybersecurity & Infrastructure Security Agency (CISA), available at https://www.cisa.gov/uscert/ncas/alerts/aa21-131a
- "Hive Ransomware" - Analysis by Palo Alto Networks, available at https://unit42.paloaltonetworks.com/hive-ransomware/
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.