Ransomware Attack on Racing Forensics by Cicada 3301
Ransomware Attack on Racing Forensics Inc by Cicada 3301
Racing Forensics Inc, a pivotal entity in the Canadian horse racing industry, has recently been targeted by the ransomware group Cicada 3301. This attack has raised significant concerns about the security of sensitive regulatory data managed by the organization.
About Racing Forensics Inc
Established in 2000, Racing Forensics Inc is a private company headquartered in Toronto, Ontario. It specializes in veterinary services related to horse racing, particularly focusing on maintaining the integrity of the sport through comprehensive regulatory services. The company is renowned for its role in the Canadian Pari-Mutuel Agency (CPMA) Equine Drug Control Program, where it serves as the official sample collector at racetracks across Canada. With a workforce of 201 to 500 employees, Racing Forensics is a significant player in its niche market, offering services such as TCO2 sample collection and testing, and administering the Exercise Induced Pulmonary Hemorrhage (EIPH) program.
Attack Overview
The ransomware attack orchestrated by Cicada 3301 has potentially compromised sensitive data, including personal information such as first and last names and email addresses. The attackers have threatened to publish the exfiltrated data if Racing Forensics does not initiate contact promptly. This incident highlights the vulnerabilities faced by organizations handling sensitive regulatory data, particularly those with valuable information that can be monetized by cybercriminals.
About Cicada 3301
Cicada 3301 is a newly emerged Ransomware-as-a-Service (RaaS) and data broker group that first gained attention in mid-2024. Unlike traditional ransomware groups, Cicada 3301 focuses on exfiltrating and selling sensitive data rather than seeking quick ransom payments. The group employs a double-extortion model, threatening to release stolen data if demands are not met. Their operations are characterized by high complexity, involving techniques such as phishing campaigns, brute-forcing VPN credentials, and exploiting vulnerabilities in network appliances.
Potential Vulnerabilities
Racing Forensics Inc's reliance on computerized documentation and networked systems for sample collection and testing may have made it susceptible to Cicada 3301's sophisticated attack methods. The group's use of the Brutus botnet for initial network access and their focus on data exfiltration before encryption are indicative of their strategic approach to targeting organizations with valuable data.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!