T A Khoury targeted by Hunters ransomware group

• Ransomware group: Hunters
• Country: Australia
• Sector: Professional Services
• Announcement date: April 9, 2024

Hunters ransomware group claims attack on T A Khoury

The threat actor known as Hunters International has officially announced on its leak site that it has targeted T A Khoury. According to the claims made by the group, the organization has fallen victim to a cyberattack involving both data exfiltration and system encryption. This announcement, which was published on April 9, 2024, marks a significant incident for the targeted entity within the professional services sector.

Ransomware attacks of this nature typically follow a pattern of double extortion. In such scenarios, threat actors do not merely lock the victim's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the stolen data on public leak sites, attackers increase the pressure on the victim to meet their demands. This method significantly increases the impact of the breach, as the exposure of data can lead to long-term reputational and legal consequences even if the systems are successfully restored.

Details of the claimed incident

The announcement made by Hunters International asserts that the group has successfully accessed the network of T A Khoury. The group claims that they have exfiltrated data from the organization's network and have subsequently encrypted the systems. The claim suggests a multi-stage operation where the integrity and confidentiality of the organization's digital environment have been compromised.

Regarding the specific contents of the breach, the listing provides no details regarding the types of exfiltrated or encrypted data. The information provided by the threat actor was limited to a screenshot displaying the group's general leak site interface, without specifying the nature of the files involved.

About T A Khoury

T A Khoury is an accounting and consulting firm based in Australia. The company provides a variety of professional services, including tax planning, accounting, and financial advisory services to both businesses and individuals. Given the nature of these services, firms in this sector often handle sensitive financial and personal information, making them high-value targets for cybercriminals seeking to exploit data for extortion or secondary malicious activities.

Analysis and potential implications

Hunters International is a group that emerged in 2023 and is assessed to be derived from the Hive ransomware codebase. This connection suggests a level of sophistication often seen in groups utilizing established ransomware frameworks. The exfiltration of an organization's data can lead to various secondary risks, such as the exposure of employee or client information, which may result in targeted phishing attacks against the individuals involved.

For an organization operating in Australia, a potential data breach may trigger specific legal obligations under the Australian Privacy Act 1988. Organizations must be prepared to navigate these regulatory requirements following a confirmed incident. Furthermore, it is noted that while this listing is from 2024, there have been reports indicating that the group ceased encryption activities in 2025, which may mean that older listings like this one reflect the group's past operational methods rather than current active campaigns.

The incident highlights the ongoing risk to professional services providers. To mitigate such risks, organizations typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to defend against initial access vectors like phishing. Maintaining operational continuity is a primary concern for any firm, and a successful ransomware attack can pose a direct threat to that continuity.