ThomasLloyd Group Hit by Cactus Ransomware Exposing 2.4 TB Data
Incident Date:
September 17, 2024
Overview
Title
ThomasLloyd Group Hit by Cactus Ransomware Exposing 2.4 TB Data
Victim
ThomasLloyd Group
Attacker
Cactus
Location
First Reported
September 17, 2024
ThomasLloyd Group Targeted by Cactus Ransomware: A Detailed Analysis
The ThomasLloyd Group, a prominent player in the sustainable investment and climate solutions sector, has recently fallen victim to a ransomware attack orchestrated by the Cactus ransomware group. This breach has resulted in the exfiltration of approximately 2.4 TB of sensitive data, significantly impacting the firm's operations and reputation.
About ThomasLloyd Group
Established in 2004 and headquartered in London, ThomasLloyd Group specializes in sustainable investment and climate solutions. The company focuses on the transition to renewable energy, providing a diverse portfolio of climate solutions aimed at governments, businesses, and individuals. Their core activities include investment management and advisory services, particularly targeting the German-speaking markets, and developing climate infrastructure projects such as biomass and solar power plants in the Philippines and India.
Despite their commitment to sustainability and impactful climate solutions, ThomasLloyd has faced significant financial challenges, including arrears on bond payments since 2020. The firm reported a turnover of £16.74 million for 2022, with total liabilities exceeding £110 million. These financial difficulties have raised concerns among investors regarding the company's viability.
Attack Overview
The Cactus ransomware group breached the USA branch of ThomasLloyd Group, resulting in the exfiltration of a wide array of sensitive information. The compromised data includes personally identifiable information (PII), personal data of employees and executives, corporate confidential documents, customer information, financial documents, corporate correspondence, and database backups. The attack has exposed vulnerabilities in ThomasLloyd's cybersecurity infrastructure, particularly in their VPN devices and data analytics platforms.
About Cactus Ransomware Group
Identified in March 2023, the Cactus ransomware group has quickly become a notable player in the ransomware landscape. The group employs sophisticated tactics, including exploiting vulnerabilities in VPN appliances and leveraging phishing attacks to gain initial access. Cactus ransomware is known for its double-extortion strategy, where they not only encrypt data but also threaten to leak sensitive information if the ransom is not paid.
The malware used by Cactus encrypts its own binary to evade detection by antivirus software, utilizing a combination of RSA and AES algorithms. Once inside a network, Cactus establishes command and control communications via SSH and uses Scheduled Tasks to maintain persistence. The group is recognized for its rapid adaptation to newly discovered vulnerabilities, making it a formidable threat in the cybersecurity landscape.
Penetration and Impact
The Cactus ransomware group likely penetrated ThomasLloyd's systems by exploiting known vulnerabilities in their VPN devices and data analytics platforms. The group's ability to encrypt its own binary and use various obfuscation techniques made it challenging for ThomasLloyd's security teams to detect and respond to the threat. The breach has not only compromised sensitive data but also highlighted the need for robust cybersecurity measures to protect against such sophisticated attacks.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.