Qilin Ransomware Strikes AC Technical Systems Ltd
Qilin Ransomware Group Targets AC Technical Systems Ltd.
AC Technical Systems Ltd., a Canadian system integrator specializing in IT network infrastructure and security solutions, has fallen victim to a ransomware attack orchestrated by the Qilin group. The attackers claim to have exfiltrated 400 GB of sensitive data, issuing a 48-hour ultimatum for the company to respond before the data is publicly released.
Company Profile and Industry Standing
Established in 1990, AC Technical Systems Ltd. is a prominent player in the security and investigations sector, known for its comprehensive development and implementation of IT network infrastructure and security systems. The company employs between 11 to 50 individuals and generates an estimated annual revenue of $1 million to $5 million. AC Technical Systems is distinguished by its ability to integrate existing security systems with new technologies, offering customized solutions that enhance security management. Their commitment to quality is underscored by their ISO 9001:2015 certification, emphasizing continuous improvement and risk management.
Attack Overview
The Qilin ransomware group, known for its sophisticated Ransomware-as-a-Service (RaaS) model, has claimed responsibility for the attack on AC Technical Systems. The group is notorious for its double extortion tactics, encrypting data and threatening to leak it unless a ransom is paid. In this instance, Qilin has reportedly infiltrated the company's systems, exfiltrating a significant amount of data. The attack highlights vulnerabilities in the company's cybersecurity defenses, potentially exploiting known vulnerabilities in Citrix ADC, RDP, or VMware ESXi.
Qilin Ransomware Group
Qilin, also known as Agenda, emerged in July 2022 and has since become a formidable threat in the ransomware landscape. The group distinguishes itself through its use of advanced encryption algorithms and cross-platform adaptability, targeting Windows, Linux, and VMware ESXi environments. Qilin's ransomware is highly customizable, allowing affiliates to tailor attacks to specific targets. The group typically gains initial access through spear phishing and exploits known vulnerabilities, using tools like Cobalt Strike for lateral movement.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!