Play Ransomware Group Targets Refcio & Associates, Compromises Sensitive Data
Incident Date:
June 13, 2024
Overview
Title
Play Ransomware Group Targets Refcio & Associates, Compromises Sensitive Data
Victim
Refcio & Associates
Attacker
Play
Location
First Reported
June 13, 2024
Ransomware Attack on Refcio & Associates by Play Ransomware Group
Overview of Refcio & Associates
Refcio & Associates, a full-service law firm based in London, Ontario, specializes in legal advisory, financial consulting, and business strategy. Founded in 2013 by Rod R. Refcio, the firm is known for its transparent, client-focused approach, offering services in real estate, business law, estate law, civil, and commercial litigation. The firm operates under the domain rrlaw.ca and has a strong online presence with positive reviews.
Details of the Ransomware Attack
The ransomware group Play has claimed responsibility for a cyberattack on Refcio & Associates. The attack compromised private and personal confidential data, including client documents, budget, payroll, accounting records, contracts, tax information, IDs, and financial information. The breach was announced on Play's dark web leak site, indicating a significant data exfiltration event.
About the Play Ransomware Group
Play ransomware, operated by Ransom House, is a notable actor in the cybercrime landscape, particularly targeting Linux systems. The group is associated with the Babuk code and has evolved to target ESXi lockers. Play ransomware is known for its unique verbose ransom notes and sophisticated encryption methods, using Sosemanuk for encryption. The group has transitioned from data theft to deploying cryptographic lockers, showcasing a sophisticated evolution in its ransomware tactics.
Potential Vulnerabilities and Penetration Methods
Refcio & Associates, like many firms in the legal sector, handles a vast amount of sensitive data, making it an attractive target for ransomware groups. The Play ransomware group likely penetrated the firm's systems through vulnerabilities in their network security, possibly exploiting weak points in their Linux-based systems. The use of tools such as AnyDesk, NetCat, and encoded PowerShell Empire scripts suggests a multi-faceted approach to achieving initial access and deploying ransomware.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.