Play Ransomware Group Targets Refcio & Associates, Compromises Sensitive Data
Ransomware Attack on Refcio & Associates by Play Ransomware Group
Overview of Refcio & Associates
Refcio & Associates, a full-service law firm based in London, Ontario, specializes in legal advisory, financial consulting, and business strategy. Founded in 2013 by Rod R. Refcio, the firm is known for its transparent, client-focused approach, offering services in real estate, business law, estate law, civil, and commercial litigation. The firm operates under the domain rrlaw.ca and has a strong online presence with positive reviews.
Details of the Ransomware Attack
The ransomware group Play has claimed responsibility for a cyberattack on Refcio & Associates. The attack compromised private and personal confidential data, including client documents, budget, payroll, accounting records, contracts, tax information, IDs, and financial information. The breach was announced on Play's dark web leak site, indicating a significant data exfiltration event.
About the Play Ransomware Group
Play ransomware, operated by Ransom House, is a notable actor in the cybercrime landscape, particularly targeting Linux systems. The group is associated with the Babuk code and has evolved to target ESXi lockers. Play ransomware is known for its unique verbose ransom notes and sophisticated encryption methods, using Sosemanuk for encryption. The group has transitioned from data theft to deploying cryptographic lockers, showcasing a sophisticated evolution in its ransomware tactics.
Potential Vulnerabilities and Penetration Methods
Refcio & Associates, like many firms in the legal sector, handles a vast amount of sensitive data, making it an attractive target for ransomware groups. The Play ransomware group likely penetrated the firm's systems through vulnerabilities in their network security, possibly exploiting weak points in their Linux-based systems. The use of tools such as AnyDesk, NetCat, and encoded PowerShell Empire scripts suggests a multi-faceted approach to achieving initial access and deploying ransomware.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!