Krypton International Hit by RansomHub Ransomware Exposing 68GB Data
RansomHub Ransomware Attack on Krypton International Resources Inc.
Krypton International Resources Inc., a key player in the manufacturing sector specializing in personal protective equipment (PPE), containment systems, and industrial lubricants, has fallen victim to a ransomware attack by the notorious RansomHub group. The breach, detected on September 16, has led to the exposure of 68 GB of sensitive data on RansomHub’s dark web leak site.
Company Profile
Krypton International Resources Inc. operates primarily in the Philippine market, providing a comprehensive range of safety solutions. With over 20 years of experience and a workforce of around 41 employees, the company is ISO-certified, ensuring adherence to international standards. Krypton’s offerings include PPE such as helmets, gloves, and protective clothing, containment systems for spill prevention, and ISO-paraffinic lubricants designed to enhance machinery efficiency.
Attack Overview
The ransomware attack has resulted in the public release of both personal and corporate information. Among the exposed data is a high-resolution scan of a Philippine non-professional driver’s license, revealing critical personal details. Additionally, confidential business documents related to Krypton’s internal operations have been compromised, posing significant legal, reputational, and financial risks to the company.
RansomHub Group Profile
RansomHub, a Ransomware-as-a-Service (RaaS) group, emerged in February and quickly gained notoriety for its aggressive affiliate model and double extortion tactics. The group is known for its speed and efficiency, utilizing advanced encryption and data exfiltration techniques. RansomHub affiliates often exploit vulnerabilities in unpatched systems and use phishing campaigns to gain initial access.
Penetration and Impact
RansomHub’s attack on Krypton likely involved exploiting vulnerabilities in the company’s IT infrastructure, such as unpatched systems or weak password policies. The group’s use of tools like Mimikatz and PsExec for lateral movement and privilege escalation, combined with their advanced data exfiltration methods, underscores the sophistication of their operations. The breach has already garnered over 380 views on RansomHub’s leak site, highlighting the potential for widespread misuse of the exposed data.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!