LockBit Ransomware Hits Oklahoma City CPA Firm
Incident Date:
August 5, 2024
Overview
Title
LockBit Ransomware Hits Oklahoma City CPA Firm
Victim
T. Philips Kierl Jr. & Associates, CPA's
Attacker
Lockbit3
Location
First Reported
August 5, 2024
LockBit Ransomware Group Targets T. Philips Kierl Jr. & Associates, CPA's
T. Philips Kierl Jr. & Associates, CPA's, a full-service accounting firm based in Oklahoma City, Oklahoma, has recently fallen victim to a ransomware attack orchestrated by the notorious LockBit group. The attack, discovered on August 5, has raised significant concerns due to the sensitive nature of the firm's operations and the potential exposure of confidential client information.
About T. Philips Kierl Jr. & Associates, CPA's
T. Philips Kierl Jr. & Associates, CPA's is a well-established accounting firm offering a comprehensive range of services, including tax preparation, accounting, and business consulting. The firm is known for its personalized service and commitment to professionalism, responsiveness, and quality. They cater to a diverse clientele, including individuals, small businesses, and larger organizations. The firm's dedication to client satisfaction has led to a growth in business primarily through client referrals.
Attack Overview
The ransomware attack on T. Philips Kierl Jr. & Associates was claimed by the LockBit group via their dark web leak site. While the exact size of the data leak remains unknown, the incident has raised significant concerns given the sensitive nature of the firm's operations. The firm is currently assessing the extent of the breach and working to mitigate the impact of the attack. The attack highlights the vulnerabilities that even well-established firms face in the ever-evolving landscape of cyber threats.
About LockBit Ransomware Group
LockBit is a highly sophisticated ransomware-as-a-service (RaaS) group that has been active since September 2019. It has become the most active ransomware group, responsible for over one-third of all ransomware attacks in the latter half of 2022 and the first quarter of 2023. LockBit employs "double extortion" tactics, exfiltrating sensitive data and threatening to release it publicly if the ransom is not paid. The ransomware uses a combination of RSA-2048 and AES-256 encryption algorithms to encrypt victims' files, making it extremely difficult to recover data without paying the ransom.
Potential Vulnerabilities
LockBit is designed to exploit vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network. It performs a check to avoid executing on computer systems with installed languages common to the Commonwealth of Independent States (CIS) region. Indicators of Compromise (IOCs) for LockBit include the creation of a mutual exclusion object (Mutex) when executed, the use of a unique icon, and changes to the victim's computer wallpaper. The attack on T. Philips Kierl Jr. & Associates underscores the importance of cybersecurity measures, especially for firms handling sensitive financial data.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.