VCUarts Qatar Hit by Dispossesor Ransomware Attack
Incident Date:
July 29, 2024
Overview
Title
VCUarts Qatar Hit by Dispossesor Ransomware Attack
Victim
VCUarts Qatar
Attacker
Dispossessor
Location
First Reported
July 29, 2024
Ransomware Attack on VCUarts Qatar by Dispossesor Group
Virginia Commonwealth University School of the Arts in Qatar (VCUarts Qatar) has recently fallen victim to a ransomware attack orchestrated by the 'Dispossesor' group. The breach was discovered on July 29, and the attackers have threatened to release samples of the compromised data on August 4. This incident has raised significant concerns within the educational sector, particularly for institutions specializing in art and design.
About VCUarts Qatar
VCUarts Qatar, established in 1998, is a branch campus of Virginia Commonwealth University located in Doha, Qatar. It was the first American university in Doha’s Education City and operates in close collaboration with VCUarts Richmond. The institution offers Bachelor of Fine Arts degrees in various disciplines, including graphic design, interior design, fashion design, painting, printmaking, and art history. With around 300 students enrolled, VCUarts Qatar is known for its comprehensive education in the arts, blending high academic standards with the cultural and artistic traditions of Qatar.
Attack Overview
The ransomware attack on VCUarts Qatar was claimed by the Dispossesor group via their dark web leak site. The attackers have threatened to release samples of the compromised data, which has put the institution on high alert. The extent of the data leak is currently unknown, and VCUarts Qatar is actively assessing the impact while taking steps to secure its systems against further breaches.
About Dispossesor Group
Dispossesor is a newly identified threat actor in the ransomware landscape, primarily functioning as a data broker rather than a traditional ransomware group. First observed in December 2023, Dispossesor capitalizes on the work of other cybercriminals by publishing data leaks from other ransomware groups. The group has claimed responsibility for attacks across various sectors, including government, healthcare, media, and finance. Dispossesor collaborates with "red teamers" and initial access brokers, allowing them to expand their operations and victim pool.
Potential Vulnerabilities
Educational institutions like VCUarts Qatar are often targeted by ransomware groups due to their extensive databases of sensitive information, including personal data of students and staff, academic records, and financial information. The collaborative nature of VCUarts Qatar, with its international partnerships and exchange programs, may also present additional vulnerabilities. The institution's reliance on digital platforms for academic and administrative functions makes it a lucrative target for cybercriminals seeking to exploit any security gaps.
Penetration Methods
While the exact method of penetration in the VCUarts Qatar attack remains unclear, Dispossesor typically gains access through vulnerabilities in network security, often leveraging existing breaches. The group's collaboration with initial access brokers and red teamers suggests a sophisticated approach to identifying and exploiting weaknesses in their targets' cybersecurity defenses.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.