DragonForce Ransomware Hits Franciscan Friars
Ransomware Attack on Franciscan Friars of the Atonement by DragonForce Group
Victim Profile: Franciscan Friars of the Atonement
The Franciscan Friars of the Atonement, a Roman Catholic religious order founded in 1898, is headquartered at Graymoor in Garrison, New York. With a mission centered on reconciliation and atonement, the order operates across the United States, Canada, England, Italy, and Japan. They specialize in religious institutions and personal services, employing approximately 87 individuals and generating an estimated revenue of $10.8 million. Their work spans from ecumenical efforts for Christian unity to social ministries aiding marginalized communities, making them a unique entity within their sector.
Attack Overview
The Franciscan Friars of the Atonement recently fell victim to a ransomware attack orchestrated by the group known as DragonForce. This attack involved the encryption of sensitive data and threats of its release unless a ransom was paid, a tactic known as double extortion. The attack was publicly claimed on DragonForce's dark web leak site, "DragonLeaks," where they often post about their exploits and negotiations with victims.
Ransomware Group: DragonForce
DragonForce is a newly emerged cyber threat group that surfaced in late 2023. Known for their double extortion tactics, they have quickly gained notoriety by targeting a variety of industries globally. Their ransomware code appears to be derived from the leaked LockBit ransomware builder, indicating a sophisticated level of technical capability in deploying ransomware attacks. DragonForce distinguishes itself by not only threatening the release of encrypted data but also by engaging in public negotiations and releasing audio recordings of these interactions on their platform.
Potential Vulnerabilities and Penetration Tactics
The Franciscan Friars of the Atonement, like many organizations in the religious and non-profit sector, may be perceived as having less stringent cybersecurity measures compared to large corporate entities. This can make them attractive targets for ransomware groups looking for easier penetration and potentially quicker ransom payments. The specific vector of attack used by DragonForce to infiltrate the Friars’ network has not been disclosed, but common tactics include phishing, exploiting unpatched software vulnerabilities, or accessing weak remote desktop protocols.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!