Cicada 3301 Ransomware Breach at Crown Mortgage Company
Cicada 3301 Ransomware Attack on Crown Mortgage Company
Crown Mortgage Company, a prominent mortgage lender based in Oak Lawn, Illinois, has recently fallen victim to a ransomware attack orchestrated by the notorious group Cicada 3301. This attack has resulted in the exfiltration of 103 GB of sensitive data, raising significant concerns about data security within the financial sector.
About Crown Mortgage Company
Established in 1975, Crown Mortgage Company has been a key player in the Chicagoland mortgage market, offering a range of loan products including conventional, FHA, and VA loans. Known for its personalized service and local approach, the company has built a strong reputation for customer satisfaction, with a high referral rate from satisfied clients. Despite its success, Crown Mortgage's classification as a small to mid-sized business may have made it an attractive target for cybercriminals, who often exploit the relatively weaker cybersecurity defenses of such organizations.
Attack Overview
The ransomware group Cicada 3301, known for its focus on data exfiltration and sale rather than traditional ransom demands, has claimed responsibility for the attack on Crown Mortgage. The group operates using a double-extortion model, threatening to release stolen data if their demands are not met. This approach underscores the importance of effective cybersecurity measures, particularly for companies handling sensitive financial data.
About Cicada 3301
Cicada 3301 distinguishes itself from other ransomware groups by prioritizing data brokerage over immediate ransom payments. Operating as a Ransomware-as-a-Service (RaaS) group, they have been linked to the Repellent Scorpius group and are known to use the Brutus botnet for initial network access. Their sophisticated tactics include exploiting vulnerabilities in VPN environments and employing advanced encryption techniques to maximize disruption.
Potential Vulnerabilities
The attack on Crown Mortgage highlights potential vulnerabilities in the company's cybersecurity infrastructure. Cicada 3301 likely gained access through phishing campaigns or by exploiting weaknesses in VPN credentials. The group's use of tools like PsExec for lateral movement and RClone for data exfiltration further emphasizes the need for comprehensive security protocols to protect against such sophisticated threats.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!