Eldorado Ransomware Attack Disrupts The Phoenix Company, Inc.
Ransomware Attack on The Phoenix Company, Inc. by Eldorado Group
The Phoenix Company, Inc., a prominent player in the insurance sector, has recently been targeted by the Eldorado ransomware group. This attack has raised significant concerns about data security and operational disruptions within the company.
Company Profile and Industry Standing
The Phoenix Company, Inc., originally founded in 1851, has a storied history in the financial services industry. Known for its pioneering efforts in life insurance marketing, the company has evolved through various transformations and mergers. It currently operates as a subsidiary of Nassau Financial Group, focusing on life insurance and related financial services. With a workforce of approximately 650 employees, the company is headquartered in Hartford, Connecticut. Its long-standing reputation and innovative practices have made it a significant entity in the insurance sector.
Details of the Ransomware Attack
The attack on The Phoenix Company was claimed by Eldorado on their dark web leak site. The cybercriminals encrypted critical data, demanding a ransom for its release. This incident has disrupted the company's operations, posing challenges in data recovery and financial stability. The attack highlights vulnerabilities in the company's cybersecurity infrastructure, which may have been exploited by the attackers.
Profile of the Eldorado Ransomware Group
Eldorado, recently rebranded as Black Lock, is a ransomware-as-a-service group known for its sophisticated malware targeting both Linux and Windows systems. The group has gained notoriety for its focus on VMware ESXi servers and its ability to evade detection through rebranding. Eldorado's malware is developed in Go, utilizing advanced encryption algorithms like ChaCha20 and RSA-OAEP. The group is believed to exploit unpatched vulnerabilities and may use Remote Desktop Protocol access to infiltrate systems.
Potential Attack Vectors
While specific details of the attack vector used against The Phoenix Company are not disclosed, it is likely that Eldorado exploited unpatched vulnerabilities within the company's systems. The group's focus on virtualized environments suggests that weaknesses in VMware ESXi servers could have been a point of entry. Additionally, the use of RDP access and recruitment of penetration testers may have facilitated the attack.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!