Play Ransomware Hits Accounting Resource Group in Cyberattack
Ransomware Attack on Accounting Resource Group by Play Ransomware
The Play ransomware group has claimed responsibility for a recent cyberattack on Accounting Resource Group, a boutique accounting firm based in Minnetonka, Minnesota. This attack has resulted in the unauthorized access and potential exfiltration of sensitive data, posing significant risks to the firm and its clients.
About Accounting Resource Group
Accounting Resource Group is a small firm with an employee count ranging from 11 to 50. Established in 1985, the firm specializes in tax advisory, compliance, accounting, bookkeeping, and consulting services. It serves a diverse clientele, including small businesses, individuals, and high-net-worth families. The firm's personalized approach and consultative services have earned it a reputation as a trusted partner in the accounting industry.
Vulnerabilities and Attack Overview
The firm's focus on personalized service and handling of sensitive financial data makes it an attractive target for cybercriminals. The Play ransomware group exploited these vulnerabilities, gaining unauthorized access to private and personal data, client documents, and critical financial records. The breach also compromised contracts, tax-related documents, and identification information, highlighting the potential for extensive operational and reputational damage.
About Play Ransomware Group
Active since June 2022, the Play ransomware group, also known as PlayCrypt, has targeted various industries, including IT, transportation, and government entities. The group is known for its sophisticated attack methods, including exploiting RDP servers, FortiOS vulnerabilities, and Microsoft Exchange vulnerabilities. Play ransomware distinguishes itself by not including an initial ransom demand in its notes, directing victims to contact them via email instead.
Potential Attack Methods
The Play group likely penetrated Accounting Resource Group's systems through vulnerabilities in remote access protocols or by exploiting known software vulnerabilities. Their use of tools like Mimikatz for privilege escalation and custom tools for network enumeration suggests a well-coordinated attack strategy. The group's ability to disable antimalware solutions further complicates detection and response efforts.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!