RansomHub Ransomware Hits Ring Power Stealing 371 GB of Data
Incident Date:
September 18, 2024
Overview
Title
RansomHub Ransomware Hits Ring Power Stealing 371 GB of Data
Victim
Ring Power Corporation
Attacker
Ransomhub
Location
First Reported
September 18, 2024
RansomHub Ransomware Attack on Ring Power Corporation
Ring Power Corporation, a prominent heavy equipment dealer headquartered in St. Augustine, Florida, has fallen victim to a ransomware attack orchestrated by the RansomHub group. The attackers claim to have exfiltrated 371 GB of data from the organization, marking a significant breach in the company's cybersecurity defenses.
About Ring Power Corporation
Founded in 1961 by L.C. Ringhaver, Ring Power Corporation has grown into one of the largest Caterpillar dealers in the Southeastern United States. The company operates across multiple sectors, including construction, agriculture, marine power, and waste management. With a workforce of approximately 1,600 employees and a revenue of around $464.4 million, Ring Power is a key player in the heavy equipment market. The company is known for its extensive product offerings, including new and used Caterpillar machinery, cranes, and power generation solutions.
Attack Overview
The ransomware attack on Ring Power Corporation was claimed by RansomHub, a Ransomware-as-a-Service (RaaS) group that emerged in February 2024. The group is known for its aggressive affiliate model and double extortion tactics, which involve encrypting victims' data and exfiltrating sensitive information to increase leverage in ransom demands. In this case, RansomHub claims to have stolen 371 GB of data from Ring Power, potentially exposing sensitive corporate and customer information.
RansomHub's Modus Operandi
RansomHub distinguishes itself through its speed and efficiency, utilizing advanced encryption techniques and targeting a wide range of systems, including Windows, Linux, and ESXi. The group often exploits vulnerabilities in unpatched systems and employs phishing campaigns and password spraying to gain initial access. Once inside, they conduct network reconnaissance, escalate privileges, and exfiltrate data before encrypting files. RansomHub's ransomware is known for its intermittent encryption, which minimizes encryption time while maintaining impact.
Potential Vulnerabilities
Ring Power Corporation's extensive operations and large workforce make it a lucrative target for ransomware groups like RansomHub. The company's reliance on digital systems for equipment sales, rentals, and servicing, as well as its international operations, increases its exposure to cyber threats. Additionally, the critical nature of the industries it serves, such as construction and marine power, makes it a high-value target for attackers seeking substantial ransom payments.
Penetration Methods
RansomHub likely penetrated Ring Power's systems through a combination of phishing campaigns and exploiting unpatched vulnerabilities. The group's affiliates are known to use tools like Mimikatz and PsExec for lateral movement and privilege escalation, making it difficult for organizations to detect and mitigate the attack in its early stages. The use of advanced data exfiltration techniques further complicates the response efforts, as sensitive information is often stolen before encryption occurs.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.