RansomHub claims to have attacked inv-dar.com

• Ransomware group: RansomHub
• Country: Saudi Arabia
• Sector: Technology
• Announcement date: August 8, 2024

RansomHub claims a ransomware attack against inv-dar.com

The ransomware group known as RansomHub has listed the Saudi Arabian organization inv-dar.com on its dedicated leak site. According to the group's announcement, they claim to have successfully carried out a ransomware attack against the company, resulting in the encryption of network systems and the exfiltration of data.

This type of activity is characteristic of modern ransomware operations, where threat actors employ a double extortion strategy. In such scenarios, attackers do not merely lock the victim's systems to demand a ransom for decryption; they also steal sensitive information to threaten its public release. This creates additional leverage for the attackers, as the victim faces the threat of regulatory penalties and reputational damage if their private data is leaked on the internet.

Details of the alleged attack

The announcement regarding the incident was published on the RansomHub leak site on August 8, 2024. While the public announcement occurred in August, the group cites the actual attack date as July 31, 2024. This gap between the intrusion and the public listing is common in cyberattacks, as threat actors often spend time navigating networks and exfiltrating data before making their presence known to the victim and the public.

The group alleges that the organization's network systems have been encrypted, which typically disrupts the ability of a company to access its own digital resources and maintain normal business operations. By encrypting files and systems, the attackers aim to paralyze the victim's workflow to increase the pressure to pay the ransom.

Information regarding the exfiltrated data

At this stage, the specific details regarding the nature and scope of the data involved in this incident remain unclear. The records provided by the group do not specify the exact files or the volume of information that was allegedly taken from the organization's systems.

The listing names no specific data types that have been targeted or stolen.

About inv-dar.com

INV-DAR is a technology and software solutions company based in Saudi Arabia. The organization provides digital transformation and IT services designed to support various corporate processes.

Implications and security considerations

The claims made by RansomHub suggest that the organization's operational continuity may have been disrupted due to the alleged encryption of their systems. Because the organization operates within the technology and software solutions sector, providing critical services for corporate processes, any disruption to their infrastructure can have cascading effects on their clients.

Furthermore, if the exfiltrated data contains sensitive information, it could lead to significant risks such as identity theft and fraud. Such risks are particularly heightened when the compromised data includes personal or financial details. RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024 and reportedly attracted various affiliates following the ALPHV incident; the group was said to have ceased operations in early 2025.

The publication of an organization's data on a leak site can lead to secondary extortion attempts or targeted phishing attacks against the company or its clients. To mitigate these risks, organizations in the technology and service sectors should consider the following defensive measures:

• Reviewing data security protocols: Regularly auditing how data is stored, accessed, and shared to ensure compliance with security standards.
• Implementing robust backup strategies: Maintaining offline or immutable backups to ensure that systems can be restored in the event of a ransomware encryption event.
• Enhancing monitoring and detection: Using advanced tools to detect unauthorized lateral movement or large-scale data transfers within the network.
• Employee awareness training: Educating staff to recognize phishing attempts, which are often used as a secondary method of exploitation following a breach.