ElDorado Ransomware Attack: City of Pensacola Breached
ElDorado Ransomware Attack on City of Pensacola
Overview of the City of Pensacola
The City of Pensacola, a government entity located in Pensacola, Florida, serves a population of 54,312 residents over an area of 40.7 square miles. The city's official website, is a comprehensive digital portal offering services and information to residents, businesses, and visitors. It provides essential services such as utility bill payments, permit applications, and public safety updates, while also supporting community engagement through resources related to health services, housing assistance, and social programs.
Details of the Ransomware Attack
In March, the ransomware group ElDorado executed a significant attack on the City of Pensacola, successfully exfiltrating 1.7TB of data. The group has since claimed responsibility and is now selling the stolen data. This attack has severely impacted the city's ability to provide services and maintain transparency with its residents.
About ElDorado Ransomware Group
ElDorado emerged in 2024 and quickly gained notoriety through a series of high-profile attacks. The group employs a double-extortion tactic, encrypting victims' files and exfiltrating sensitive data. Victims are threatened with the public release of this data if they do not comply with ransom demands. ElDorado's meticulous approach involves thorough reconnaissance to identify valuable data, which is then exfiltrated and encrypted.
Penetration Tactics
The ransomware group ElDorado uses a diverse set of tactics to infiltrate systems, including phishing attacks, exploiting unpatched vulnerabilities, and weaknesses in Remote Desktop Protocol (RDP) configurations. They also execute supply chain attacks, targeting vulnerabilities in software suppliers or third-party vendors. Once inside a network, they use legitimate system administration tools for malicious purposes, making their activities harder to detect.
Impact and Vulnerabilities
The City of Pensacola's extensive digital services and public-facing website made it a prime target for ElDorado. The attack has highlighted vulnerabilities in the city's cybersecurity defenses, particularly in areas such as software updates and RDP configurations. The exfiltration of 1.7TB of data underscores the severity of the breach and the potential risks to residents' personal information and city operations.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!