Ransomware Attack on Ascent Group Exposes 80GB of Sensitive Data
Ransomware Attack on Ascent Group by RA World
Overview of Ascent Group
The Ascent Group, headquartered in Singapore, is an Independent Global Fund Administrator providing comprehensive fund administration services. They cater to asset managers, capital markets, family offices, and private investors. The company specializes in various fund structures, including Hedge Funds, Unit Trust Funds, Fund of Funds, Singapore Variable Capital Company (VCC), Limited Partnership Funds, Private Equity, Managed Accounts, and Venture Capital Funds. Their services include FATCA reporting, CRS reporting, US tax reporting, middle office services, directorship, corporate secretarial services, corporate accounting and audit, and foreign exchange solutions.
Company Size and Industry Standing
Ascent Group is recognized as one of the fastest-growing companies in the fund administration space, with a significant presence in the Asia-Pacific region. They operate 15 offices and employ over 200 staff members. The company prides itself on maintaining high service levels and strong client relationships, leveraging their global footprint and extensive industry expertise to deliver tailored solutions.
Details of the Ransomware Attack
RA World, a notorious ransomware group, has claimed responsibility for a cyberattack on Ascent Group. The attackers allege they have exfiltrated 80GB of sensitive data, including legal and financial documents, customer information, employee records, and business contracts. The group has threatened to leak or permanently encrypt the data unless a ransom is paid. This incident underscores the critical need for robust cybersecurity measures in the financial services sector.
About RA World
RA World is an emerging ransomware group that has been active since early 2024. They are a rebranded version of the RA Group and utilize a custom version of the leaked Babuk ransomware source code. The group employs double extortion tactics, exfiltrating sensitive data before encryption, and uses a multi-stage attack process designed for maximum impact. RA World has targeted various sectors, including healthcare, finance, manufacturing, and retail, with a significant focus on the United States, Europe, and Southeast Asia.
Potential Vulnerabilities and Attack Vector
Ascent Group's extensive handling of sensitive financial data makes them an attractive target for ransomware groups like RA World. The attackers likely exploited vulnerabilities in the company's cybersecurity infrastructure, potentially through phishing attacks or exploiting unpatched software. The use of Group Policy Objects (GPOs) for lateral movement and anti-AV measures further facilitated the breach, allowing the attackers to evade detection and maximize their impact.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!