IJM Corporation listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: Malaysia
• Sector: Professional Services
• Announcement date: February 23, 2024

Hunters claims ransomware attack on IJM Corporation

The threat group known as Hunters has listed IJM Corporation on their leak site, alleging that the organization has been targeted in a ransomware attack. This announcement, posted on February 23, 2024, marks the latest instance of the group targeting a major corporate entity. According to the claims made by the threat actors, the attack involved encryption activities carried out directly on the organization's systems.

Ransomware attacks typically involve a malicious actor gaining unauthorized access to a network and deploying software designed to encrypt files, rendering them inaccessible to the legitimate owners. Once the encryption is complete, the attackers often demand a ransom payment in exchange for the decryption key. While some groups focus on data exfiltration to pressure victims—a tactic known as double extortion—the current claim regarding IJM Corporation focuses specifically on the disruption caused by encryption.

Details of the alleged incident

The incident was officially announced on the Hunters leak platform on February 23, 2024. The threat actors claim that they successfully carried out encryption activities across the organization's systems. This type of attack is intended to halt business operations by making critical digital assets and infrastructure unusable until a ransom is addressed.

Regarding the specifics of the breach, the announcement states that while the systems were encrypted, no data exfiltration was reported by the group. The listing does not provide information regarding the specific volume of data involved or the total number of files affected. Furthermore, no specific ransom demand has been made public in the current announcement.

Affected data

The listing names no specific data types that were involved in the alleged incident.

About IJM Corporation

IJM Corporation is a Malaysia-based multinational conglomerate. The company maintains a diverse operational portfolio, including sectors such as construction, property development, infrastructure concessions, and industry. IJM Corporation is widely recognized for its involvement in large-scale infrastructure projects and its extensive real estate development activities.

Impact assessment and industry implications

The alleged attack suggests that the organization's operational continuity may have been disrupted. The encryption of systems can lead to significant interruptions in business processes and potential financial losses. Because the Hunters group is assessed to use the Hive codebase, it is possible that similar techniques or methodologies associated with that codebase were employed during this incident.

Given that IJM Corporation is based in Malaysia, an assessment under local data protection regulations may be required to ensure compliance with regional privacy standards. Additionally, there are secondary risks to consider, such as the potential for operational downtime to impact various supply chain partners who rely on the organization's services.

For organizations operating in the professional services and infrastructure sectors, such incidents highlight the importance of robust defensive measures. Common defensive steps include maintaining offline, immutable backups to facilitate recovery without paying ransoms, implementing strict network segmentation to prevent lateral movement, and enforcing multi-factor authentication across all remote access points. Continuous monitoring and incident response planning are also essential to mitigate the impact of encryption-based attacks and to manage the complexities of supply chain dependencies.