Krypton International Hit by RansomHub Ransomware Exposing 68GB Data
Incident Date:
September 18, 2024
Overview
Title
Krypton International Hit by RansomHub Ransomware Exposing 68GB Data
Victim
Krypton Resources
Attacker
Ransomhub
Location
First Reported
September 18, 2024
RansomHub Ransomware Attack on Krypton International Resources Inc.
Krypton International Resources Inc., a key player in the manufacturing sector specializing in personal protective equipment (PPE), containment systems, and industrial lubricants, has fallen victim to a ransomware attack by the notorious RansomHub group. The breach, detected on September 16, has led to the exposure of 68 GB of sensitive data on RansomHub’s dark web leak site.
Company Profile
Krypton International Resources Inc. operates primarily in the Philippine market, providing a comprehensive range of safety solutions. With over 20 years of experience and a workforce of around 41 employees, the company is ISO-certified, ensuring adherence to international standards. Krypton’s offerings include PPE such as helmets, gloves, and protective clothing, containment systems for spill prevention, and ISO-paraffinic lubricants designed to enhance machinery efficiency.
Attack Overview
The ransomware attack has resulted in the public release of both personal and corporate information. Among the exposed data is a high-resolution scan of a Philippine non-professional driver’s license, revealing critical personal details. Additionally, confidential business documents related to Krypton’s internal operations have been compromised, posing significant legal, reputational, and financial risks to the company.
RansomHub Group Profile
RansomHub, a Ransomware-as-a-Service (RaaS) group, emerged in February and quickly gained notoriety for its aggressive affiliate model and double extortion tactics. The group is known for its speed and efficiency, utilizing advanced encryption and data exfiltration techniques. RansomHub affiliates often exploit vulnerabilities in unpatched systems and use phishing campaigns to gain initial access.
Penetration and Impact
RansomHub’s attack on Krypton likely involved exploiting vulnerabilities in the company’s IT infrastructure, such as unpatched systems or weak password policies. The group’s use of tools like Mimikatz and PsExec for lateral movement and privilege escalation, combined with their advanced data exfiltration methods, underscores the sophistication of their operations. The breach has already garnered over 380 views on RansomHub’s leak site, highlighting the potential for widespread misuse of the exposed data.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.