Rhysida Ransomware Strikes Matlock Security Services

Incident Date: Dec 07, 2024

Attack Overview
VICTIM
Matlock Security Services
INDUSTRY
Business Services
LOCATION
USA
ATTACKER
Rhysida
FIRST REPORTED
December 7, 2024

Rhysida Ransomware Group Targets Matlock Security Services

Matlock Security Services, a well-established provider of commercial security solutions based in Tulsa, Oklahoma, has recently fallen victim to a ransomware attack allegedly orchestrated by the notorious Rhysida group. This incident underscores the persistent threat posed by ransomware actors targeting businesses across various sectors.

Company Profile and Vulnerabilities

Founded in 1980, Matlock Security Services has built a reputation for delivering tailored security solutions to industries such as healthcare, retail, education, and government. With a workforce of approximately 11 to 20 employees, the company generates an estimated annual revenue between $1 million and $5 million. Despite its expertise in security, Matlock's relatively small size and focus on sensitive sectors allegedly make it an attractive target for ransomware groups like Rhysida.

Attack Overview

The Rhysida ransomware group claims to have infiltrated Matlock Security's database, threatening to release the compromised data within a week. The specifics of the data breach remain undisclosed, leaving Matlock in a challenging position as they assess the breach's impact. The company has yet to publicly address the attack or outline their response strategy.

Rhysida Ransomware Group

Emerging in May 2023, Rhysida has quickly established itself as a formidable player in the Ransomware-as-a-Service ecosystem. Known for targeting high-value sectors, the group employs tactics such as phishing and VPN exploitation to gain access to networks. Rhysida's double extortion model, demanding ransoms for both data decryption and to prevent data exposure, places significant pressure on victims.

Potential Penetration Methods

Rhysida's attack on Matlock Security likely involved exploiting vulnerabilities in the company's network, possibly through phishing or unpatched VPN services. The group's use of "living-off-the-land" tactics, leveraging legitimate system tools to evade detection, underscores the sophistication of their operations. This approach allows them to blend into regular network activity, making it challenging for organizations to detect and mitigate the threat.

Sources

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.