Ransomware Attack on Experis Technology Group by Play Ransomware Group
Incident Date:
May 22, 2024
Overview
Title
Ransomware Attack on Experis Technology Group by Play Ransomware Group
Victim
Experis Technology Group
Attacker
Play
Location
First Reported
May 22, 2024
Ransomware Attack on Experis Technology Group by Play Ransomware Group
Victim Profile
Experis Technology Group, a Hybrid Cloud architecture firm based in the USA, specializes in providing IT infrastructure and cloud solutions to large and mid-market enterprises, as well as federal system integrators. With over two decades of experience in the industry, Experis Technology Group stands out for its unique solutions for mission success and commitment to delivering best-in-class infrastructure solutions[1][2].
Attack Overview
The cybercrime group Play targeted Experis Technology Group in a ransomware attack, exfiltrating sensitive data such as private and personal confidential information, client documents, budget details, payroll records, accounting data, contracts, tax information, IDs, and financial data. The ransom demand details were not disclosed, highlighting the severe impact of ransomware attacks on technology firms and the security of corporate and personal information[3].
Ransomware Group Profile
The Play ransomware group, operated by Ransom House, is known for targeting Linux systems and has evolved to deploy cryptographic lockers. Play ransomware shares similarities with Baseline Babuk in terms of encryption methods and file searching functionality, using Sosemanuk for encryption. The group distinguishes itself with a unique verbose ransom note content that provides explicit instructions to victims on how to contact the actors[4].
Attack Vulnerabilities
Experis Technology Group's focus on providing high availability infrastructure systems and ensuring continuous performance for mission-critical workloads may have made them a target for threat actors like the Play ransomware group. The company's expertise in Private, Public, & Hybrid Cloud solutions, Server-Storage & Hyper-converged systems, Business Continuity & Data Availability, and WAN/LAN & WiFi infrastructure could have attracted cybercriminals seeking valuable data and disrupting operations[1][2].
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.