LockBit 3.0 Ransomware Attack on Robinson, Farmer, Cox Associates
Ransomware Attack on Robinson, Farmer, Cox Associates by LockBit 3.0
Victim Profile
Robinson, Farmer, Cox Associates (RFC) is a Virginia-based CPA firm founded in 1953 by Daniel A. Robinson, Sr. The firm offers auditing, tax, and accounting services to governments, individuals, businesses, and non-profit entities. RFC is known for its expertise in governmental auditing and consulting, serving 68 of Virginia's 95 counties and various local governments, cities, and non-profit organizations.
Company Size and Industry Standing
RFC operates in the Business Services sector and has multiple office locations in Virginia, including Charlottesville, Blacksburg, Fredericksburg, Louisa, Richmond, and Staunton. The firm specializes in governmental and nonprofit audits, individual and business taxes, and consulting services for local governments and the public sector. RFC's professionals provide personalized services to each client, making them stand out in the industry.
Attack Details
LockBit 3.0, a Ransomware-as-a-Service (RaaS) group, targeted RFC in a ransomware attack, encrypting the company's data and potentially causing operational disruptions. The attackers demanded a ransom, posing a threat to the confidentiality and integrity of RFC's information. The compromised website, rfca.com, added to the challenges faced by RFC in recovering their data.
The ransomware group is an advanced variant of the LockBit ransomware group. It encrypts files, modifies filenames, changes desktop wallpapers, and drops ransom notes. The ransomware is highly obfuscated, making it challenging for security researchers to analyze. LockBit 3.0 has features like lateral movement through networks and self-trace deletion, enhancing its evasiveness.
Company Vulnerabilities
The attacked company's extensive client base and expertise in governmental auditing make them an attractive target for threat actors like LockBit 3.0. The firm's reliance on sensitive financial data and the critical services they provide to governments and non-profit organizations increase their vulnerability to ransomware attacks.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!