Florida Memorial University Hit by Cybersecurity Breach

Florida Memorial University (FMU) has reportedly fallen victim to a cybersecurity breach by the ransomware group INC Ransom. The specifics of the data compromised during this incident remain uncertain, and the university has yet to issue a formal statement regarding the breach. INC Ransom has uploaded a “proof pack” on its website, showcasing scans of passports, Social Security numbers, and contractual documents, ostensibly sourced from FMU’s databases.

Florida Memorial University is a private, historically black college in Miami Gardens, Florida. It is a member of the United Negro College Fund and historically related to Baptists, although it claims a focus on broader Christianity. The university is acknowledged as a National Center of Academic Excellence in Cyber Defense, a distinction awarded by the United States National Security Agency (NSA).

About INC Ransom

INC Ransom was first observed in the summer of 2023, and it is unclear if they maintain a RaaS (Ransomware-as-a-Service) affiliate operation or are a closed group. INC uses common TTPs (Tactics, Techniques, and Procedures), such as leveraging compromised RDP (Remote Desktop Protocol) credentials to gain access and move laterally in a targeted environment. INC has been observed delivering ransomware using legitimate tools like WMIC and PSEXEC and using other Living-off-the-Land (LOTL) techniques, abusing applications including MSPaint, WordPad, NotePad, MS Internet Explorer, MS Windows Explorer, and AnyDesk for lateral movement.

INC has also been observed abusing tools like Esentutl for reconnaissance and MegaSync for data exfiltration. INC is written in C++, uses AES-128 in CTR mode to encrypt files, and has a Linux version. It is unclear if INC employs any advanced security tool evasion techniques, and there are indications that they may attempt to delete Volume Shadow Copies (VSS) to hinder encryption rollback attempts.

INC's Modus Operandi

INC targets a wide array of industries, including manufacturing, retail, IT, hospitality, pharma, construction, and the public sector. INC practices double extortion and maintains a leak site for double extortion, threatening to expose the victim. INC has made good on threats to expose sensitive data if a target does not pay the ransom demand.