Ransomware Attack on First Commonwealth Federal Credit Union by Meow Ransomware Group
Ransomware Attack on First Commonwealth Federal Credit Union by Meow Ransomware Group
Overview of First Commonwealth Federal Credit Union
First Commonwealth Federal Credit Union, headquartered in Allentown, Pennsylvania, is a member-owned, not-for-profit cooperative financial institution. Founded in 1959, it serves over 94,000 members and businesses in the Lehigh Valley region. As the largest credit union in the area, it offers a wide range of banking services, including savings accounts, certificates of deposit (CDs), loans, and online banking. The credit union is known for its competitive rates and low fees compared to traditional banks. It also actively participates in community initiatives, such as sponsoring the giraffe exhibit at the Lehigh Valley Zoo and organizing events like the Business Clothing Drive.
Details of the Ransomware Attack
On July 16, 2024, First Commonwealth Federal Credit Union discovered that it had fallen victim to a ransomware attack orchestrated by the Meow ransomware group. The attack targeted the institution's domain, firstcomcu.org. While the exact size of the data leak remains unknown, the incident has raised significant concerns about the security of sensitive financial information belonging to its members and businesses. The credit union is currently assessing the full impact of the breach and working to mitigate any potential damage.
About Meow Ransomware Group
Meow Ransomware is a threat actor group that emerged in late 2022 and has been associated with the Conti v2 ransomware variant. The group resurfaced in late 2023 and has been highly active in 2024, primarily targeting organizations in the United States. Meow Ransomware employs various infection methods, including phishing emails, exploit kits, Remote Desktop Protocol (RDP) vulnerabilities, and malvertising. Once a system is compromised, the ransomware encrypts files using a combination of the ChaCha20 and RSA-4096 algorithms. The group maintains a data leak site where they list victims who have not paid the ransom.
Potential Vulnerabilities and Penetration Methods
First Commonwealth Federal Credit Union, like many financial institutions, holds a vast amount of sensitive data, making it an attractive target for ransomware groups. The Meow ransomware group could have penetrated the credit union's systems through several vectors, including phishing emails, exploiting RDP vulnerabilities, or using exploit kits. The cooperative model of the credit union, which focuses on member benefits rather than profit maximization, may also mean that cybersecurity investments are balanced with other priorities, potentially creating vulnerabilities.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!