Gruyéria Hit by RansomHub Ransomware: Data Exfiltrated
RansomHub Ransomware Attack on Gruyéria
Gruyéria, a family-owned business based in Bulle, Switzerland, has recently fallen victim to a ransomware attack orchestrated by the cybercriminal group RansomHub. The attack has resulted in the exfiltration of a significant amount of sensitive data, posing a severe threat to the company's operations and reputation.
About Gruyéria
Established in 1885, Gruyéria specializes in the creation of living spaces through custom furniture and interior design solutions. The company operates a factory in Bulle, where it manages the entire production process, including design, prototyping, and manufacturing. Gruyéria is known for its craftsmanship in manufacturing made-to-measure panels and furniture, catering to both residential and commercial clients. The company employs between 51 and 100 individuals and has a registered capital of CHF 900,000.
Attack Overview
The ransomware attack on Gruyéria was claimed by RansomHub via their dark web leak site. The attackers exfiltrated various file folders and Outlook data files, including an "Administration" folder, a "Dats" folder, a "Projets" folder, and a "Secretariat" folder, all dated 31/2024. Additionally, two substantial Outlook data files were exfiltrated: "Archives_2022.pst" and "EMail pst," with sizes of 948,369 KB and 19,083,865 KB, respectively. This breach has potentially exposed critical business information.
About RansomHub
RansomHub, a Ransomware-as-a-Service (RaaS) group, emerged in February 2024. The group is known for its aggressive affiliate model and double extortion tactics, encrypting victims' data and exfiltrating sensitive information for additional leverage. RansomHub targets high-value sectors such as healthcare, financial services, and government. The group uses advanced techniques, including intermittent encryption and Curve 25519 elliptic curve encryption, to optimize their ransomware's efficiency and impact.
Penetration Methods
RansomHub affiliates primarily use phishing campaigns, vulnerability exploitation, and password spraying to gain initial access. They exploit unpatched systems and zero-day vulnerabilities to infiltrate networks. Once inside, they conduct multi-phase attacks involving network reconnaissance, privilege escalation, and data exfiltration before encrypting files. The group's sophisticated tactics and techniques make them a formidable threat to organizations worldwide.
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!