Qilin Ransomware Strikes Bock & Associates, LLP: A Growing Cyber Threat

Incident Date:

June 13, 2024

World map

Overview

Title

Qilin Ransomware Strikes Bock & Associates, LLP: A Growing Cyber Threat

Victim

Bock & Associates, LLP

Attacker

Qilin

Location

El Paso, USA

Texas, USA

First Reported

June 13, 2024

Qilin Ransomware Group Targets Bock & Associates, LLP

Overview of the Attack

Bock & Associates, LLP, a certified public accounting firm based in El Paso, Texas, has fallen victim to a ransomware attack orchestrated by the Qilin group. The breach was discovered on June 13, 2024, and the extent of the data leak remains unknown. The firm, known for its tax services, payroll solutions, and general accounting services, has been in operation for over 48 years.

About Bock & Associates, LLP

Bock & Associates, LLP employs between 6-10 people and generates annual revenue of $1M-$5M. The firm prides itself on professionalism, experience, and affordability, offering a broad range of services for business owners, executives, and independent professionals. Despite not being accredited by the Better Business Bureau, the firm has no customer complaints or negative reviews, highlighting its commitment to exceptional service.

Vulnerabilities and Targeting

As a small to mid-sized firm, Bock & Associates, LLP may lack the robust cybersecurity infrastructure of larger organizations, making it a prime target for ransomware groups like Qilin. The firm's extensive handling of sensitive financial data further increases its attractiveness to cybercriminals seeking valuable information for double extortion tactics.

About the Qilin Ransomware Group

The Qilin ransomware group, also known as Agenda, emerged in 2022 and has quickly become a significant threat. Specializing in ransomware-as-a-service (RaaS), Qilin targets critical infrastructure and other essential services worldwide. Their ransomware, written in Rust and Go, is known for its evasion capabilities and customization options, complicating recovery efforts for victims.

Penetration Tactics

Qilin typically infiltrates systems through phishing emails containing malicious links. Once inside, they move laterally across the network, searching for critical data to encrypt. The group employs a double extortion technique, exfiltrating sensitive data and demanding payment for both decryption and non-disclosure. Their high payout rates to affiliates make them a formidable and attractive option for cybercriminals.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.