RansomHub Ransomware Hits Advanced Business Events Disrupting Operations
RansomHub Ransomware Attack on Advanced Business Events (ABE)
Advanced Business Events (ABE), a prominent organizer of business conventions, conferences, and congresses, has fallen victim to a ransomware attack orchestrated by the cybercriminal group RansomHub. The attack has been explicitly claimed by RansomHub, indicating their involvement and responsibility.
About Advanced Business Events (ABE)
Founded in 1984, ABE specializes in organizing tailored business conventions across various industry sectors, including aerospace, automotive, and defense. The company operates from its headquarters in Boulogne-Billancourt, France, with additional offices in Toulouse, France, and Rome, Italy. ABE has organized over 1,000 events across 46 countries, serving more than 120,000 customers. Their standout feature lies in their ability to customize events that cater to specific industry needs, providing a platform for one-to-one meetings and networking opportunities.
Attack Overview
The ransomware attack on ABE was claimed by RansomHub via their dark web leak site. RansomHub, a Ransomware-as-a-Service (RaaS) group, is known for its aggressive affiliate model and double extortion tactics. The group encrypts victims' data and exfiltrates sensitive information to leverage ransom demands. The attack on ABE highlights the vulnerabilities of organizations in the business services sector, particularly those with extensive digital operations and valuable data.
About RansomHub
RansomHub emerged as a successor to the Cyclops and Knight ransomware variants, filling a power vacuum created by law enforcement actions against other groups. The group is renowned for its speed and efficiency, targeting large enterprises with valuable data and critical operations. RansomHub affiliates primarily use phishing campaigns, vulnerability exploitation, and password spraying to gain initial access. The group's ransomware is optimized to encrypt large datasets quickly while targeting a wide range of cross-platform systems.
Penetration and Impact
RansomHub's affiliates likely penetrated ABE's systems through a combination of phishing campaigns and exploiting unpatched vulnerabilities. Once inside, they conducted network reconnaissance, escalated privileges, and exfiltrated data before encrypting files. The attack has disrupted ABE's operations, potentially compromising sensitive information related to their extensive portfolio of events and customer base.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!