Hunters International Ransomware Targets T A Khoury & Co

Hunters International ransomware group has listed T A Khoury & Co on its dark web leak site, claiming to have stolen 63.7 gigabytes worth of data. Although the specifics of the data are unknown, the gang divided the files into two categories – “Client Files” and “Financial Data”. While both sections have 63.7 gigabytes of data each, the exact same amount of data and the identical number of files (149,205) suggest that both categories hold the same data.

T A Khoury & Co is a Charter Accountant Firm providing a range of comprehensive, professional, and personalized services to a wide range of companies, individuals, trusts, and superannuation funds all over Australia. It offers a range of accounting, tax, and financial advice services, from tax compliance to financial planning.

The Emergence of Hunters International

Hunters International, a Ransomware-as-a-Service (RaaS) group, emerged in Q3 of 2023 after the discovery of source code bearing resemblances to the infamous Hive ransomware strain. In October 2023, a security researcher's analysis of the ransomware used by Hunters revealed significant code overlaps with Hive ransomware. Subsequent analysis by Bitdefender came to the same findings, leading researchers to conclude that Hive operators have handed off their malicious tool to another threat actor. Despite this, Hunters International has denied any ties to the Hive operation.

Operational Tactics and Impact

Intelligence suggests that Hunters International ransomware primarily aims to exfiltrate target data and extort victims with ransom demands for its return. One reported incident involved a plastic surgery clinic in the US, where approximately 248,000 files, including patient names and addresses, were exfiltrated. The ransomware encrypts files with the ".LOCKED" extension and leaves "Contact Us.txt" files in directories, instructing victims on how to initiate negotiation on the dark web.

Successful exploitation by Hunters International typically results in significant data exfiltration prior to issuing a ransom demand, often tailored to the perceived value of the compromised organization.