LockBit Ransomware Attack on Town & Forest Accounting UK: Data Breach Details
LockBit Ransomware Attack on Town & Forest Accounting UK
Overview of the Attack
Town & Forest Accounting UK, a prominent chartered accountancy firm based in St Albans, Hertfordshire, has fallen victim to a ransomware attack orchestrated by the notorious LockBit group. The attackers have threatened to release the firm's sensitive data on July 17, 2024, and have already posted sample screenshots on their DarkWeb portal as proof of the breach. This incident highlights the increasing threat of ransomware attacks on financial institutions.
About Town & Forest Accounting UK
Town & Forest Accounting UK is a chartered accounting firm that offers a comprehensive range of financial services tailored to meet the diverse needs of businesses and individuals. The firm, which employs between 11 to 50 individuals, prides itself on blending traditional values with a modern approach. Their services include statutory audits, financial statement preparation, tax planning and compliance, bookkeeping, and company secretarial services. The firm is known for its client-centric approach, emphasizing open communication and personalized advice.
Vulnerabilities and Targeting
As a financial institution, Town & Forest Accounting UK holds a significant amount of sensitive data, making it an attractive target for ransomware groups like LockBit. The firm's reliance on digital systems for bookkeeping, financial reporting, and client communication may have exposed vulnerabilities that the attackers exploited. The use of advanced technology, while beneficial for streamlining processes, also necessitates robust cybersecurity measures to protect against sophisticated threats.
About LockBit Ransomware Group
LockBit, also known as LockBit Black, is a highly sophisticated ransomware-as-a-service (RaaS) group that has been active since September 2019. It is responsible for a significant portion of ransomware attacks globally. LockBit employs "double extortion" tactics, exfiltrating sensitive data and threatening to release it publicly if the ransom is not paid. The ransomware uses a combination of RSA-2048 and AES-256 encryption algorithms to encrypt victims' files, making it extremely difficult to decrypt without paying the ransom.
Penetration Methods
LockBit is known for exploiting vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network. The ransomware also performs a check to avoid executing on systems with languages common to the Commonwealth of Independent States (CIS) region. Indicators of Compromise (IOCs) for LockBit include the creation of a mutual exclusion object (Mutex) when executed, the use of a unique icon, and changes to the victim's computer wallpaper. The group’s ability to modify its behavior via command-line parameters further complicates detection and mitigation efforts.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!