Royal Ransomware Group On An Extortion Tear

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, the Royal ransomware underwent a rebrand, a ransomware attack struck a financial system used by French museums and a putative class action over a massive background check data breach. Also, Singapore removed an app monitoring internet use on student devices, a warning about the legacy Cisco Smart Install protocol, the upstart SharpRhino criminal gang is on the move, and a researcher found an exposed Illinois voter database.

See Also: Effective Communication Is Key to Successful Cybersecurity

The BlackSuit ransomware group, formerly known as Royal, extorted more than $500 million from victims since its emergence in September 2022, according to a report from the US Cybersecurity and Infrastructure Security Agency and the FBI. The Wedneday report details the group’s operations, including ransom demands ranging from $1 million to $10 million, typically requested in Bitcoin.

BlackSuit gained notoriety after high-profile attacks, including one on the City of Dallas last year, which disrupted public services.

The group uses phishing emails to gain initial access and disables antivirus software and exfiltrates data before deploying ransomware. BlackSuit’s largest single ransom demand reached $60 million, though the group is known to negotiate lower payments.

A ransomware attack targeted the centralized financial system used by around 40 French museums over the weekend, including notable institutions such as the Louvre, Palace of Versailles and Orsay, local media reported Monday.

The attack was first detected at the Grand Palais museum, host to Olympic fencing and martial arts events. The incident resulted in the Grand Palais servers being cut off, affecting the associated museums’ 36 bookstores and boutiques, though museum operations themselves were not disrupted.

An unidentified hacker group demanded a cryptocurrency ransom and threatened to release encrypted data within 48 hours. French security agency ANSSI confirmed it received an alert about the hacking but emphasized that the hacked systems were not involved in the Paris Olympics.

Background-check company Jerico Pictures, which does business as National Public Data, faces a proposed class-action lawsuit after a data breach that exposed the personal information of nearly 3 billion individuals. The cybercriminal group USDoD posted on April 8 a database titled “National Public Data” on a criminal forum, claiming to have the personal data of 2.9 billion people. Other members of the criminal forum have since posted what they said was the entire file.

The lawsuit, filed in the US District Court for the Southern District of Florida, alleges that National Public Data failed to notify affected individuals or provide warnings as of the filing date.

National Public Data collects personal information by scraping non-public sources, reportedly exposing Social Security numbers, full names, addresses and details about relatives, some deceased for decades.

Named plaintiff Christopher Hofmann, who learned of the breach through his identity-theft protection service, accuses National Public Data of negligence, unjust enrichment, and other legal violations. He seeks monetary relief and demands that the company purge all affected data, encrypt future collections, and implement strict cybersecurity measures, including annual third-party assessments.

The Singapore Ministry of Education removed the Mobile Guardian app from students’ learning devices following a global cybersecurity breach that impacted 13,000 students across 26 secondary schools. The breach, discovered on Aug. 4, allowed unauthorized access to the app, which manages device usage by restricting screen time and access to specific content. Affected devices were remotely wiped but the ministry said no student files were accessed.

The ministry said on Aug. 5 the app will be removed from all iPads and Chromebooks to safeguard students.

This incident follows unrelated technical issues reported since July. The issues, attributed to human error in Mobile Guardian’s configuration, caused problems with device functionality. Mobile Guardian has investigating the breach, which also impacted users in the United States and Europe.

Hackers are abusing the legacy Cisco Smart Install feature, warned the U.S. Cyberecurity and Infrastructure Security Agency in a Thursday advisory recommending that the protocol be disabled. Hackers exploiting SMI isn’t a new problem: Cisco itself warned users in early 2017 that hackers use the “‘plug-and-play’ configuration and image-management feature” to hack routers.
“Malicious Smart Install protocol messages can allow an unauthenticated, remote attacker to change the startupconfig file, force a reload of the device, load a new IOS image on the device, and execute high-privilege CLI commands on switches running Cisco IOS and IOS XE Software,” the National Security also warned in 2017. In addition to consulting the NSA guidance, CISA recommended consulting NSA guidance from October 2023 on network infrastructure security.

The cybersecurity defense agency also warned that it’s continuing to spot weak password types to safeguard device passwords within a system configuration file. “The use of weak password types enables password cracking attacks. Once access is gained a threat actor would be able to access system configuration files easily,” allowing the hacker to do obviously bad things on the network.

Upstart criminal group Hunters International unleashed a new malware strain SharpRhino, targeting network administrators. Disguised as the popular Angry IP Scanner tool, SharpRhino is distributed through typo-squatted websites, slightly misspelt URLs designed to trick victims into downloading malicious code.

The malware has been active since mid-June and is embedded in a fake version of the IP scanner tool named ipscan-3.9.1-setup.exe, discovered Quorum Cyber. The installer contains a password-protected archive, which, when unpacked, reveals an application named Microsoft.AnyKey.exe. SharpRhino modifies the RunUpdateWindowsKey registry to execute this application, which is derived from a Microsoft Visual Studio 2019 Node JS tool.

The malware establishes communication with two command-and-control systems: one for initial payload delivery and another for ongoing access and persistence. Once installed, SharpRhino uses a Rust-based encryptor to lock files, leaving behind a ransom note directing victims to a Tor payment page.

SharpRhino is suspected to be the work of Hunters International, a ransomware-as-a-service group that emerged in October 2023.

Nearly 4.6 million Illinois voter and election documents containing sensitive personal information – including Social Security numbers and drivers license data were exposed on publicly accessible, non-password protected databases, according to cybersecurity researcher Jeremiah Fowler, who shared his findingsVPNMentor.

Fowler said the exposed databases contained troves of sensitive documents – including the physical addresses and personal cell number of political candidates and full Social Security numbers for millions of voters – before they were eventually restricted by a third-party contractor. While some voter registration information is already easily accessible online, the exposure raises concerns about identity theft and other fraud risks .

“It is not known how long the documents were exposed or if anyone else gained access,” Fowler said. “Only an internal forensic audit could identify additional access or suspicious activity.”

Other Stories From Last Week

With reporting from Information Security Media Group’s Chris Riotta in Washington, D.C., and David Perera in Washington, D.C.