RansomHub Ransomware Hits DEL Electric, 143GB Data Compromised
RansomHub Ransomware Attack on DEL Electric: A Detailed Analysis
DEL Electric, officially known as Douglas Electric & Lighting, Inc., a leading commercial electrical contractor based in Hunt Valley, Maryland, has fallen victim to a ransomware attack by the notorious RansomHub group. The attack, discovered on November 11, has compromised 143 GB of sensitive data, threatening the confidentiality of high-profile projects and client information.
About DEL Electric
Founded in 1993, DEL Electric has established itself as a prominent player in the electrical construction industry, particularly within the Baltimore area. With a workforce of 51 to 200 employees, the company generates annual revenues between $25 million and $50 million. DEL Electric is known for its comprehensive electrical services, including design-build and plan & specification projects, catering to sectors such as general contracting and development. The company's commitment to customer service and financial stability has made it a reliable partner for contractors and developers.
Attack Overview
The RansomHub ransomware group has claimed responsibility for the attack, which has resulted in the unauthorized access to sensitive data, including architectural plans and financial transaction reports. The compromised data pertains to high-profile clients such as the Baltimore Country Club and Johns Hopkins University. RansomHub has threatened to release this data within a week, putting significant pressure on DEL Electric to respond.
RansomHub's Modus Operandi
RansomHub, a Ransomware-as-a-Service group, emerged in February and quickly gained notoriety for its aggressive affiliate model and double extortion tactics. The group is known for its speed and efficiency, targeting large enterprises with valuable data. RansomHub's ransomware is optimized for cross-platform systems, utilizing advanced data exfiltration techniques to maximize impact.
Potential Vulnerabilities
DEL Electric's reliance on digital infrastructure for managing complex electrical projects may have made it vulnerable to RansomHub's sophisticated attack methods. The group likely exploited vulnerabilities in unpatched systems or used phishing campaigns to gain initial access. Once inside, RansomHub affiliates could have conducted network reconnaissance and privilege escalation to exfiltrate data before encrypting files.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!