Hunters International attacks Chicony Electronics
Incident Date:
April 15, 2024
Overview
Title
Hunters International attacks Chicony Electronics
Victim
Chicony Electronics
Attacker
Hunters International
Location
First Reported
April 15, 2024
The Hunters International Ransomware Gang Targets Chicony Electronics
Background
The Hunters International ransomware gang has attacked Chicony Electronics, a Taiwan-based multinational electronics manufacturer. The company's product lineup includes input devices, power supplies, and digital image products. They offer a variety of products such as desktop keyboards, mobile keyboards, digital cameras, personal computer cameras, integrated webcams, and digital video cameras.
Emergence of Hunters International
Hunters International, a Ransomware-as-a-Service (RaaS) group, surfaced in Q3 of 2023 following the discovery of source code similarities to the notorious Hive ransomware strain. Security researchers found significant code overlaps between the ransomware used by Hunters and the Hive ransomware. Bitdefender's analysis confirmed these findings, indicating a potential handoff of malicious tools from the Hive operators to another threat actor. Despite these connections, Hunters International has denied any association with the Hive operation.
Modus Operandi
Intelligence reports suggest that Hunters International ransomware focuses on exfiltrating target data and extorting victims with ransom demands for its return. In one documented case, a plastic surgery clinic in the US had approximately 248,000 files, including patient names and addresses, exfiltrated. The ransomware encrypts files with the ".LOCKED" extension and places "Contact Us.txt" files in directories, providing instructions for victims to engage in negotiations on the dark web. Successful attacks by Hunters International often involve significant data exfiltration before issuing a ransom demand, which is typically customized based on the perceived value of the compromised organization.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.