Ransomware Hits Howard CPAs ElDorado Breach Exposes Data
Ransomware Attack on Howard CPAs: A Closer Look at the ElDorado Breach
Howard CPAs, a prominent accounting firm based in Florida, has recently fallen victim to a ransomware attack orchestrated by the ElDorado group. Known for its comprehensive suite of accounting services, Howard CPAs serves small to mid-sized businesses, offering accounting, bookkeeping, payroll management, tax preparation, and business consulting. The firm operates under various names, including Howard, Howard and Hodges, and Howard CPA, LLC, and is recognized for its client-centric approach and professional affiliations.
Company Profile and Vulnerabilities
Howard CPAs has established itself as a standout in the accounting sector, emphasizing personalized service and building valuable relationships with clients across diverse industries. Despite its strong market presence, the firm’s handling of sensitive financial data makes it an attractive target for cybercriminals. The attack underscores the vulnerabilities inherent in professional service firms that manage large volumes of confidential information.
Attack Overview
The ransomware group ElDorado, which emerged in early 2024, has claimed responsibility for the attack on Howard CPAs. The group operates as a Ransomware-as-a-Service (RaaS) platform, utilizing advanced techniques to infiltrate and encrypt data. ElDorado's malware, written in Golang, targets both Windows and Linux systems, including VMware ESXi. The attack on Howard CPAs involved the encryption of files, potentially compromising sensitive client data and financial records.
ElDorado Ransomware Group
ElDorado distinguishes itself through its cross-platform capabilities and sophisticated encryption methods. The group uses ChaCha20 for file encryption and RSA-OAEP for key encryption, making it a formidable threat. ElDorado's recruitment of affiliates and pentesters on dark web forums further enhances its operational reach. The group’s ability to customize attack parameters allows for tailored assaults on specific targets, increasing the likelihood of successful breaches.
Potential Penetration Methods
While specific details of the breach remain undisclosed, ElDorado likely exploited vulnerabilities in Howard CPAs' network infrastructure. The ransomware's ability to encrypt files on shared networks using the SMB protocol and its tactic of removing shadow volume copies on Windows systems suggest a well-coordinated attack. The firm's reliance on digital systems for managing client data may have provided an entry point for the cybercriminals.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!