Scottish university hit by Rhysida ransomware gang

Stolen documents

The Rhysida ransomware gang – which draws its name from a family of large centipedes found across Africa, Central and South America, and South and Southeast Asia – is a relatively new operation which has yet to accumulate victims at scale, and about which little is known, although in June 2023, it was behind the leak of a tranche of documents stolen from the Chilean Army, according to Bleeping Computer.

According to analysts at SentinelOne, who have been able to probe the group’s modus operandi, Rhysida exhibits a number of traits shared by other ransomware gangs, including the delusion that it is a group of penetration testers who are doing their victims a favour, and the use of double extortion tactics as exhibited in the UWS attack.

It is deployed via fairly standard methods, including the use of phishing campaigns and via legitimate testing frameworks such as Cobalt Strike.

SentinelOne said the locker itself is likely in the early stages of its development cycle, as the payloads lack many commodity features synonymous with more widely used ransomwares, such as VSS removal.

Its ransom notes appear as PDF documents in affected folders on targeted drives, and instruct victims to contact the gang via its Tor-based portal using a unique identifier provided in the note. It takes payment in Bitcoin only.

Powerhouses of data

SonicWall EMEA vice-president Spencer Starkey said: “Schools and universities are huge powerhouses of data which hold incredibly sensitive information, making them a likely target for hackers. Educational institutions often have relatively weaker cyber security measures compared to other sectors because they have limited budgets and resources allocated to cyber security. The education sector is a vital institution which sits at the very centre of our society. Students, teachers and parents alike need to be able to trust that their sensitive information is being kept safe.”

Pointing to data compiled by SonicWall in its mid-year threat report that seems to suggest ransomware attacks are down in general, Starkey said that improved law enforcement focus on the issue and better cyber security practice appeared to be paying off.

“[But] these lowered numbers do not mean education institutions can breathe a sigh of relief,” he said. “In fact, it’s much the opposite, despite the drop in ransomware, attacks of all other varieties have risen, as criminals are searching elsewhere for a quicker payday.”

Another study produced by Sophos and released this week found that sector by sector, education reported the highest rate of ransomware attacks during 2022, with up to 79% of higher educational organisations saying they had been hit, and 80% of schools, up from 64% and 56% in 2021 respectively.

Unfortunately, the sector also reported one of the highest rates of ransom payment, with 56% of universities and colleges paying up, and 47% of schools doing so, resulting in significantly increased recovery costs running into the millions.

“Most schools are not cash-rich, [but] they are very highly visible targets with immediate widespread impact in their communities,” said Sophos field chief technology officer Chester Wisniewski.

“The pressure to keep the doors open and respond to calls from parents to ‘do something’ likely leads to pressure to solve the problem as quickly as possible without regard for cost.”