Play Ransomware Hits Accounting Resource Group in Cyberattack
Incident Date:
October 8, 2024
Overview
Title
Play Ransomware Hits Accounting Resource Group in Cyberattack
Victim
Accounting Resource Group
Attacker
Play
Location
First Reported
October 8, 2024
Ransomware Attack on Accounting Resource Group by Play Ransomware
The Play ransomware group has claimed responsibility for a recent cyberattack on Accounting Resource Group, a boutique accounting firm based in Minnetonka, Minnesota. This attack has resulted in the unauthorized access and potential exfiltration of sensitive data, posing significant risks to the firm and its clients.
About Accounting Resource Group
Accounting Resource Group is a small firm with an employee count ranging from 11 to 50. Established in 1985, the firm specializes in tax advisory, compliance, accounting, bookkeeping, and consulting services. It serves a diverse clientele, including small businesses, individuals, and high-net-worth families. The firm's personalized approach and consultative services have earned it a reputation as a trusted partner in the accounting industry.
Vulnerabilities and Attack Overview
The firm's focus on personalized service and handling of sensitive financial data makes it an attractive target for cybercriminals. The Play ransomware group exploited these vulnerabilities, gaining unauthorized access to private and personal data, client documents, and critical financial records. The breach also compromised contracts, tax-related documents, and identification information, highlighting the potential for extensive operational and reputational damage.
About Play Ransomware Group
Active since June 2022, the Play ransomware group, also known as PlayCrypt, has targeted various industries, including IT, transportation, and government entities. The group is known for its sophisticated attack methods, including exploiting RDP servers, FortiOS vulnerabilities, and Microsoft Exchange vulnerabilities. Play ransomware distinguishes itself by not including an initial ransom demand in its notes, directing victims to contact them via email instead.
Potential Attack Methods
The Play group likely penetrated Accounting Resource Group's systems through vulnerabilities in remote access protocols or by exploiting known software vulnerabilities. Their use of tools like Mimikatz for privilege escalation and custom tools for network enumeration suggests a well-coordinated attack strategy. The group's ability to disable antimalware solutions further complicates detection and response efforts.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.