Multisuns Communication Hit by Hunters International Ransomware
Incident Date:
July 4, 2024
Overview
Title
Multisuns Communication Hit by Hunters International Ransomware
Victim
Multisuns Communication
Attacker
Hunters International
Location
First Reported
July 4, 2024
Analysis of the Ransomware Attack on Multisuns Communication by Hunters International
Company Profile: Multisuns Communication
Multisuns Communication, a Taiwanese technology firm established in 2002, has carved a niche in the telecommunications sector by specializing in the development and manufacturing of advanced communication devices. With over 500 employees, the company stands out for its commitment to innovation and the use of cutting-edge technology in product design. Multisuns is particularly renowned for its digital voice logging solutions, call management systems, and emergency communication systems, making it a pivotal player in modern telecommunications and corporate communication infrastructures.
Details of the Ransomware Attack
The ransomware attack on Multisuns Communication was orchestrated by the group known as Hunters International. This incident led to the compromise of significant amounts of sensitive data, including 58.6 GB and 16,522 files from the HR department, and a total of 103.2 GB and 22,528 files, with an additional 51 GB and 14 files from the database. The attack not only disrupted the company's operations but also posed a severe risk to data integrity and privacy.
Profile of Hunters International
Hunters International, a Ransomware-as-a-Service (RaaS) group, emerged in the third quarter of 2023, showing substantial technical similarities with the previously dismantled Hive ransomware group. This group is known for its sophisticated encryption methods and tactics, which they likely inherited or adapted from Hive. Hunters International focuses on exfiltrating data and extorting their victims, demanding ransoms for the return of stolen data. Despite their recent emergence, they have already targeted a wide range of victims across different regions and industries.
Analysis of Attack Penetration
The specific methods by which Hunters International penetrated Multisuns Communication's defenses remain under investigation. However, typical entry points for such attacks include phishing emails, exploiting unpatched vulnerabilities, or accessing weakly secured remote desktop protocols. Given Multisuns' extensive involvement in telecommunications and data management, any lapse in their cybersecurity measures could provide a gateway for cybercriminals to infiltrate their systems.
Vulnerabilities and Industry Impact
The attack on Multisuns Communication underscores the vulnerabilities inherent in companies involved in data-intensive sectors. As providers of critical communication infrastructure, the breach of their systems not only jeopardizes customer data but also affects the reliability of communication services essential for various sectors including emergency services and financial institutions. This incident highlights the need for continuous enhancement of cybersecurity measures in the telecommunications industry, particularly for firms like Multisuns that handle large volumes of sensitive data.
Sources:
- SOCRADAR: Dark Web Profile - Hunters International
- Quorum Cyber: Malware Reports - Hunters International Ransomware Report
- Netenrich: Hunters International Group - Identity Exposure
- Global Security Mag: Hive Ransomware's Offspring - Hunters International Takes the Stage
- Accountants Daily: Australian Accounting Firm Held to Ransom by Hunters International
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.