You'll recognise a RansomHouse attack when a note appears, indicating that your systems are now inaccessible, and your data is encrypted. The specialist threat actors will demand payment, typically in cryptocurrency for discreet transactions. If you fail to pay, they will threaten to either delete or leak your data.
A break-in at your offices would compel you to call the police immediately and touch nothing until they arrive, understanding the need for forensic work to take place.
A cyber-attack requires the same action. Your first responsibility would be to call in the forensic experts and ensure the environment remains untouched.
This is not a job for your IT team or MSP. There are digital forensic specialists available 24/7 who can assist you.
RansomHouse emerged in March 2022 as a multi-faceted extortion threat that provides Ransomware-as-a-Service (RaaS). Although the group's origins remain unconfirmed, the group's brand of ransomware shares code with the infamous Russian ransomware group Babuk. According to internal sources, the group's primary objective is extortion and not encryption, portraying themselves as a 'force for good,' that exposes security flaws in target companies. RansomHouse has primarily targeted large enterprises and corporate networks.
Their strategy is straightforward, prioritise resource investment in data theft and vulnerability exploration. This approach makes their attacks less intricate compared to those that involve encrypting victims' assets. The group employs phishing and spear phishing emails to reach its victims, often utilising third-party tools such as Vatet Loader, Metasploit, and Cobalt Strike. The group is identifiable via their unique ransomware variant, dubbed Mario ESXi, along with MrAgent, used to target both Windows and Linux-based systems.
The group employs a multi-extortion strategy, utilising a TOR-based chat room as part of their operations. They extort victims in two phases: initially by encrypting their files and demanding a ransom, and subsequently by naming and shaming those who refuse to pay on their chat forum, along with publishing the stolen data from the victims.
This dual threat significantly heightens the pressure on victims and has become increasingly popular among cyber criminals because it maximises their chances of receiving payment.
RansomHouse emerged in March 2022. However, since the group shares code with the Russian ransomware group Babuk, it is possible that RansomHouse is a continuation of an earlier group, making its exact age difficult to determine.
Under its current name, the group has claimed responsibility for 135 attacks.
Solace Cyber’s track record includes hundreds of successful response recoveries, providing Digital Forensic Incident Response services, 24x7x365.
“In Europe, U.K. companies are the most likely to be targeted by phishing attacks, followed by Spain.”
Read more...
When a cyber incident occurs, take these immediate actions:
Solace Cyber acts as your specialist digital forensics partner in Australia, helping restore normal operations swiftly. Our response includes:
Recovery timelines typically range from 2 weeks to 2 months, depending on the incident's scope.
Solace Cyber delivers global risk and security services across Australia, specialising in travel, crisis support, and offshore risk management. The organisation runs a fully staffed security operations centre around the clock and maintains an internal intelligence unit that produces routine daily and weekly updates. The business is certified to ISO 27001, ISO 14001, ISO 45001, and ISO 9001 standards.
Founded in the UK in 2021, Solace Cyber has grown its presence throughout Australia, concentrating on cyber incident handling, including digital forensics, incident response, ransomware events, information security, and wider risk management, supported by managed security services. The senior leadership team has more than two decades of combined experience across security and IT.
s
%+
A forensic analysis needs to be meticulous and a clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:
Solace Cyber was established precisely for this scenario. We have a well-defined process for handling cyber-attacks like RansomHouse, which involves a 6-step approach:
It includes a thorough digital forensic analysis from step 2 where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:
It is critical that the analysis of digital evidence is carried out to an agreed plan. This will have been designed to provide the best and earliest chance of discovering a root cause, which is essential to inform remediation/eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.
Solace’s Digital Forensic and Incident Response teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident, delivering successful business recovery.
Solace Cybers' assistance extends beyond recovery. After restoring your business operations, we work collaboratively to ensure your cyber security posture is robust using a threat-informed methodology. This involves leveraging our comprehensive 9-step framework known as the Solace Global - Cyber 9 Step Process.
A RansomHouse ransomware attack generally enters a system in one of the following ways:
We recommend you adopt policies to:
After recovering from a RansomHouse attack, Solace Cyber recommends that you update your business continuity plan to account for lessons learnt during this attack & recovery.
The average cost of ransomware breaches hover around £500K, while smaller email data breaches typically incur expenses of around £50K. A critical decision emerges between preserving the environment for forensic analysis or opting for swift recovery to minimise business disruption. Delays in identifying and resolving breaches only exacerbate costs.
Cybersecurity insurance claims entail a multifaceted process, encompassing reasonable expenditures for investigation and remediation, alongside coverage for legal, business interruption, criminal liability, employment liability, and ransom policies. While the insurance industry plays a pivotal role in facilitating business recovery, cyber insurance is perceived as volatile within the sector, and many policies require meticulous validation.
Navigating the nuances requires experience, which is where Solace Cyber comes in.
Facing genuine pressure, there's a crucial decision to make - one that could rescue your organisation from weeks of operational standstill, reputation damage, and client data loss. Yet, the probability of a favourable outcome remains slim, emphasising the importance of engaging a specialised ransomware incident response team. They are your most viable recourse for navigating a ransomware incident.
The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home
Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.
The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets
Yes. There's a possibility that some of the lost data contains "Personal Data" belonging to your customers. Safeguarding such data is a legal requirement, so it's important to consider notifying the Information Commissioner's Office (ICO) at https://ico.org.uk/ about this incident, as well as your customers.
Your insurer or legal counsel will provide guidance on the necessary steps and how to proceed in this matter. However, Solace Cyber has experience collaborating with insurers and legal representatives and can offer assistance in managing these relationships during this challenging period.
Your business operations may experience significant disruptions. These could include:
To mitigate these effects, it's crucial to have a comprehensive incident response plan in place, including communication strategies, collaboration with cybersecurity experts, and measures to enhance system resilience and data protection. Additionally, transparency with stakeholders and proactive steps to rebuild trust can help minimize the long-term consequences on your business.
Action Fraud is the UK’s national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Action Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.
If your systems are showing signs of an RansomHouse attack, REMAIN CALM.
YOU MUST NOT TOUCH THEM, RESTORE OR OVERWRITE THE DATA (explanation above).
Contact Solace Cyber on +61 (0) 282 786100 or complete our form for a call back from one of our experts.
We will act promptly to reduce your business downtime.
Solace Cyber helps companies across Australia recover from ransomware attacks and data breaches.
Ransomware Recovery
Ransomware Groups
BEC Recovery
About Us
Blog
News
SOLACE CYBER LTD is registered in England & Wales no. 08830710
Solace Cyber
Zensec Ltd,
60 Martin Place,
Sydney,
NSW 2000
Telephone
Please note that calls may be recorded for security and training purposes.
