Ransomware Attack on Ryder Scott Co. by Play Ransomware Group

Incident Date: May 22, 2024

Attack Overview
VICTIM
Ryder Scott Co.
INDUSTRY
Energy, Utilities & Waste
LOCATION
USA
ATTACKER
Play
FIRST REPORTED
May 22, 2024

Ransomware Attack on Ryder Scott Co. by Play Ransomware Group

Victim Overview

Ryder Scott Company, a petroleum consulting firm based in Houston, Texas, was targeted by the cybercrime group Play in a ransomware attack. The company independently estimates oil and gas reserves, future production profiles, and cashflow economics, providing expert guidance to clients in the oil and gas industry.

Company Profile

Ryder Scott has 109 employees in the U.S. and has been in business since 1937, showcasing a substantial presence in the petroleum consulting industry. The company stands out for its commitment to professionalism, integrity, and quality service, aiming to be the preferred oil and gas engineering and geological consultants worldwide.

Attack Details

The attackers exfiltrated sensitive data from Ryder Scott, including private and personal confidential information, client documents, budgets, payroll records, accounting data, contracts, tax information, IDs, and financial data. This data was subsequently leaked by the threat actors, highlighting the severity of the attack.

Ransomware Group Profile

The Play ransomware group, operated by Ransom House, is known for targeting Linux systems and has evolved to deploy cryptographic lockers. The group distinguishes itself with a unique approach to victim communication and shares code similarities with other Babuk variants, showcasing a sophisticated evolution in ransomware tactics.

Attack Penetration

Play ransomware actors have been observed submitting binaries containing hack tools and utilities associated with ransomware techniques after achieving initial access to Ryder Scott's systems. The group's focus on Linux environments and its adoption of cryptographic lockers may have enabled them to penetrate the company's defenses.

Sources:

Disclaimer

The Halcyon Attacks Lookout Database is compiled using publicly available information based on the hosting choices of real-world threat actors and data from a variety of trackers. This information is provided in accordance with principles of fair use. Halcyon has made reasonable efforts to sanitize and verify the data; however, we do not guarantee the accuracy, completeness, or reliability of the information provided. Updates to the database are made as new source data becomes available from reputable sources.  By accessing, viewing, or using the information within the Halcyon Attacks Lookout Database, you acknowledge and agree to do so entirely at your own risk. No reliance should be placed upon the information for decision-making, and Halcyon disclaims all liability for any inaccuracies or omissions in the data.

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.