InfraCom Subsidiary Faces Major Ransomware Data Breach
Incident Date:
September 29, 2024
Overview
Title
InfraCom Subsidiary Faces Major Ransomware Data Breach
Victim
Condere Ip, Infracom Group
Attacker
Play
Location
First Reported
September 29, 2024
Ransomware Attack on InfraCom Group's Subsidiary: A Closer Look at the Play Ransomware Incident
In a significant cybersecurity breach, Condere Ip, a subsidiary of the InfraCom Group, has been targeted by the notorious Play ransomware group. This attack has compromised a vast array of sensitive data, including confidential client information, financial records, and personal identification details. InfraCom Group, a prominent player in the IT infrastructure sector, is known for its comprehensive suite of services, including cloud-based telephony, IT security, and data center operations.
About InfraCom Group
Established in 1999, InfraCom Group AB is a key player in the telecommunications and IT infrastructure sectors, serving approximately 20,000 clients across various industries. The company is renowned for its digital communication solutions, including a cloud-based private branch exchange (PBX) that supports over 100,000 users. InfraCom's focus on IT security, with offerings ranging from basic antivirus to advanced ransomware protection, underscores its commitment to safeguarding client data. The company operates its own data centers in Sweden, ensuring high levels of data security and operational reliability.
Details of the Attack
The Play ransomware group, active since June 2022, has claimed responsibility for the attack on Condere Ip. Known for targeting a diverse range of industries, the group has expanded its operations from Latin America to North America and Europe. The attackers have exploited vulnerabilities in the company's systems, potentially through compromised VPN accounts or Microsoft Exchange vulnerabilities. The breach has resulted in the exposure of critical data, posing significant risks to InfraCom's operations and reputation.
About the Play Ransomware Group
The Play ransomware group, also known as PlayCrypt, distinguishes itself through its sophisticated attack methods and diverse victimology. The group employs various techniques to gain initial access, including exploiting RDP servers and FortiOS vulnerabilities. Once inside, they use tools like Mimikatz for privilege escalation and custom tools for data exfiltration. The group's dark web presence is notable, as they post information about their attacks on their data leak site, directing victims to contact them via email for ransom negotiations.
Potential Vulnerabilities
InfraCom's extensive IT infrastructure and reliance on cloud-based solutions may have presented vulnerabilities that the Play ransomware group exploited. Despite the company's security measures, including 24/7 monitoring through a Security Operations Center, the attack highlights the persistent threat posed by sophisticated ransomware groups. This incident underscores the importance of continuous vigilance and advanced security protocols to protect against evolving cyber threats.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.