RansomHub Ransomware Hits Natural Curiosities: Key Details Revealed

Incident Date: Aug 11, 2024

Attack Overview
VICTIM
Natural Curiosities
INDUSTRY
Retail
LOCATION
USA
ATTACKER
Ransomhub
FIRST REPORTED
August 11, 2024

RansomHub Ransomware Attack on Natural Curiosities: A Detailed Analysis

Natural Curiosities, a Los Angeles-based art house known for its luxurious and eclectic wall decor, has become the latest victim of a ransomware attack by the notorious group RansomHub. The attack has compromised the company's files and webmails, putting sensitive information at risk.

About Natural Curiosities

Natural Curiosities is a design services company specializing in nature-inspired wall art collections. Established over 20 years ago, the company operates out of Chatsworth, California, and employs between 11 to 50 individuals. Their offerings include beach scenes, nature landscapes, and music-inspired art, characterized by artistic craftsmanship and a deep appreciation for the natural world. Customization is a key aspect of their services, allowing clients to request personalized pieces tailored to their specific preferences.

Attack Overview

The ransomware attack on Natural Curiosities was orchestrated by RansomHub, a relatively new but increasingly notorious ransomware group. The attackers gained access to the company's servers, encrypting and exfiltrating sensitive information. RansomHub has threatened to leak all private documents unless a ransom is paid, putting the company's confidential data at significant risk.

About RansomHub

RansomHub is a ransomware group believed to have roots in Russia, operating as a Ransomware-as-a-Service (RaaS) entity. Affiliates receive 90% of the ransom money, with the remaining 10% going to the main group. The group has targeted various countries, including the US, Brazil, Indonesia, and Vietnam, with a notable focus on healthcare-related institutions. RansomHub's ransomware strains are written in Golang, a language choice that aligns with recent trends in the ransomware world.

Penetration and Vulnerabilities

While the exact method of penetration remains unclear, it is likely that RansomHub exploited vulnerabilities in Natural Curiosities' cybersecurity infrastructure. Small to medium-sized businesses like Natural Curiosities often lack the comprehensive cybersecurity measures of larger enterprises, making them attractive targets for ransomware groups. The use of Golang in RansomHub's ransomware strains may have also played a role, as this language can sometimes evade traditional security defenses.

Sources

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.