AUM listed on Hive ransomware leak site

• Ransomware group: Hive
• Announcement date: July 4, 2022

Hive ransomware group claims compromise of AUM

The Hive ransomware group has officially listed the organization AUM on its digital leak site. According to the announcement made on July 4, 2022, the threat actors claim to have successfully compromised the systems of AUM. This claim suggests that the organization's data may be under threat of public disclosure by the group.

The group alleges that they gained unauthorized access to the organization's internal systems and subsequently exfiltrated data. Such claims are a common tactic used by ransomware groups to pressure victims into paying ransoms. In these scenarios, the threat actors typically threaten to release sensitive information on their public platforms if their demands are not met, a tactic often referred to as double extortion.

Details of the claimed attack

The event was officially announced on the group's digital platform on July 4, 2022. The group's claim involves the unauthorized access and exfiltration of data from AUM's systems. While the group has published this announcement on their leak site, the specific details regarding the breach remain limited.

Regarding the contents of the alleged breach, there is no information available regarding the nature of the leaked or threatened data. Furthermore, the group has not provided any screenshots to substantiate their claims or to demonstrate the scope of the data they have allegedly acquired.

Data and impact details

• The listing names no specific data types.

Because no specific information was provided by the group, the exact volume and type of information involved in this incident remain unknown at this time.

Analysis of the threat actor and potential risks

The Hive group is identified as a Ransomware-as-a-Service (RaaS) group that emerged in 2021. This business model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks. It is notable that the group's infrastructure was disrupted by the US Federal Bureau of Investigation in January 2023.

This incident may indicate potential vulnerabilities in the organization's data security processes. When a group claims to have exfiltrated data, it introduces significant secondary risks. For the organization's customers and employees, such claims could lead to identity theft or targeted phishing attacks. These types of attacks often leverage stolen information to gain further access to systems or to defraud individuals.

Depending on the region where the organization operates, legal processes and administrative sanctions may arise under relevant data protection regulations. Organizations facing such threats often prioritize incident response and forensic investigations to determine the scope of the breach. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify and mitigate vulnerabilities before they can be exploited by threat actors.