RansomHub Ransomware Hits Ring Power Stealing 371 GB of Data
RansomHub Ransomware Attack on Ring Power Corporation
Ring Power Corporation, a prominent heavy equipment dealer headquartered in St. Augustine, Florida, has fallen victim to a ransomware attack orchestrated by the RansomHub group. The attackers claim to have exfiltrated 371 GB of data from the organization, marking a significant breach in the company's cybersecurity defenses.
About Ring Power Corporation
Founded in 1961 by L.C. Ringhaver, Ring Power Corporation has grown into one of the largest Caterpillar dealers in the Southeastern United States. The company operates across multiple sectors, including construction, agriculture, marine power, and waste management. With a workforce of approximately 1,600 employees and a revenue of around $464.4 million, Ring Power is a key player in the heavy equipment market. The company is known for its extensive product offerings, including new and used Caterpillar machinery, cranes, and power generation solutions.
Attack Overview
The ransomware attack on Ring Power Corporation was claimed by RansomHub, a Ransomware-as-a-Service (RaaS) group that emerged in February 2024. The group is known for its aggressive affiliate model and double extortion tactics, which involve encrypting victims' data and exfiltrating sensitive information to increase leverage in ransom demands. In this case, RansomHub claims to have stolen 371 GB of data from Ring Power, potentially exposing sensitive corporate and customer information.
RansomHub's Modus Operandi
RansomHub distinguishes itself through its speed and efficiency, utilizing advanced encryption techniques and targeting a wide range of systems, including Windows, Linux, and ESXi. The group often exploits vulnerabilities in unpatched systems and employs phishing campaigns and password spraying to gain initial access. Once inside, they conduct network reconnaissance, escalate privileges, and exfiltrate data before encrypting files. RansomHub's ransomware is known for its intermittent encryption, which minimizes encryption time while maintaining impact.
Potential Vulnerabilities
Ring Power Corporation's extensive operations and large workforce make it a lucrative target for ransomware groups like RansomHub. The company's reliance on digital systems for equipment sales, rentals, and servicing, as well as its international operations, increases its exposure to cyber threats. Additionally, the critical nature of the industries it serves, such as construction and marine power, makes it a high-value target for attackers seeking substantial ransom payments.
Penetration Methods
RansomHub likely penetrated Ring Power's systems through a combination of phishing campaigns and exploiting unpatched vulnerabilities. The group's affiliates are known to use tools like Mimikatz and PsExec for lateral movement and privilege escalation, making it difficult for organizations to detect and mitigate the attack in its early stages. The use of advanced data exfiltration techniques further complicates the response efforts, as sensitive information is often stolen before encryption occurs.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!