RAO d.o.o. Faces Ransomware Threat from APT73/BASHE Group
Ransomware Attack on RAO d.o.o. by APT73 / BASHE / BASHE: A Cybersecurity Analysis
RAO d.o.o., a Croatian IT services company specializing in software solutions and consulting services, recently fell victim to a ransomware attack orchestrated by the threat actor group APT73 / BASHE / BASHE. This attack has raised concerns about the company's cybersecurity posture and the evolving landscape of cyber threats.
Company Profile
RAO d.o.o. is a small enterprise based in Zagreb, Croatia, with a workforce of approximately 28 employees. The company has been operational for over two decades, focusing on software development and consulting services related to business informatization and digital transformation. RAO d.o.o. stands out in the IT industry for its tailored software solutions and personalized consulting services, catering to a wide range of clients across different sectors.
Attack Overview
APT73 / BASHE / BASHE, a ransomware group known for its aggressive tactics, targeted RAO d.o.o. and claimed to have accessed 0.03 GB of the company's data. The attackers leaked sample screenshots as proof of the breach, indicating a successful infiltration of the company's systems. This breach has potentially exposed sensitive information and disrupted RAO d.o.o.'s operations, highlighting the critical need for enhanced cybersecurity measures.
Ransomware Group: APT73 / BASHE / BASHE
APT73 / BASHE / BASHE is a threat actor group that has gained notoriety for its ransomware attacks on organizations worldwide. The group distinguishes itself by employing sophisticated encryption methods and double-extortion strategies, threatening to leak stolen data if ransom demands are not met. APT73 / BASHE / BASHE's operational model mirrors that of established ransomware groups, indicating a level of expertise in cybercrime tactics.
Vulnerabilities and Penetration
RAO d.o.o.'s vulnerabilities to ransomware attacks may stem from its focus on software development and consulting services, which involve handling sensitive client data. The company's size and industry prominence could make it an attractive target for threat actors seeking to exploit potential security gaps. APT73 / BASHE / BASHE likely penetrated RAO d.o.o.'s systems through phishing emails, unpatched software vulnerabilities, or weak network defenses, highlighting the importance of proactive cybersecurity measures.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!