INC Ransom attacks CellNetix Pathology and Laboratories
Incident Date:
January 8, 2024
Overview
Title
INC Ransom attacks CellNetix Pathology and Laboratories
Victim
CellNetix Pathology and Laboratories
Attacker
Inc Ransom
Location
First Reported
January 8, 2024
INC Ransom Claims Attack on CellNetix Pathology and Laboratories
INC Ransom claimed a ransomware attack on CellNetix Pathology and Laboratories. The victim filed a notice of data breach with the Attorney General of Maine after discovering that an unauthorized party was able to access portions of its computer network. In this notice, CellNetix explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, which includes their names, Social Security numbers, driver’s license numbers, state identification numbers, dates of birth, passport numbers, and health insurance policy numbers or health insurance identification numbers.
CellNetix Pathology and Laboratories is a provider of anatomic pathology based out of Seattle, Washington. CellNetix serves hospitals and other healthcare providers throughout the Pacific Northwest, offering a wide range of pathology services, including molecular pathology, pediatric pathology, cytopathology, liver pathology and more.
INC Ransom's Operations
INC Ransom was first observed in the summer of 2023, and it is unclear if they maintain a RaaS (Ransomware-as-a-Service) affiliate operation or are a closed group. INC uses common TTPs (Tactics, Techniques, and Procedures) such as leveraging compromised RDP (Remote Desktop Protocol) credentials to gain access and move laterally in a targeted environment. INC has been observed delivering ransomware using legitimate tools like WMIC and PSEXEC and uses other Living-off-the-Land (LOTL) techniques, abusing applications including MSPaint, WordPad, NotePad, MS Internet Explorer, MS Windows Explorer, and AnyDesk for lateral movement.
INC has also been observed abusing tools like Esentutl for reconnaissance and MegaSync for data exfiltration. INC is written in C++ and uses AES-128 in CTR mode to encrypt files, and it also has a Linux version. It is unclear if INC employs any advanced security tool evasion techniques, and there are indications that they may attempt to delete Volume Shadow Copies (VSS) to hinder encryption rollback attempts.
Target Industries and Extortion Practices
INC targets a wide array of industries, including manufacturing, retail, IT, hospitality, pharma, construction, and the public sector. INC practices double extortion and maintains a leaks site for double extortion, threatening to expose victim data. INC has made good on threats to expose sensitive data if a target does not pay the ransom demand.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.