Faith-Based Daily Awareness Post 19 August 2024

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.

Ransomware Hits Washington DC Church

Members who receive our daily ransomware data leak site report will see that today a Washington D.C.-based church was featured on the report as a victim of ransomware threat actor group RansomHub. This serves as an important reminder that houses of worship and religious-affiliated nonprofits are absolutely targeted in this brand of cybercrime.  

Analyst Comments:

RansomHub recently made headlines when they claimed to exfiltrate and publish 100 gigabytes of sensitive data from the Florida Department of Health after the department refused to pay a ransom.  Florida, in compliance with guidelines from the Cybersecurity and Infrastructure Security Agency, has a policy of not paying ransomware demands, as payment does not guarantee an organization will regain access to its data or be able to resume normal operations.

Florida’s policy on payments is important to consider, as cyber criminals can’t be trusted, and there is no guarantee that payment will result in the return or destruction of an organization’s data. As an example, in SOC Radar’s profile on RansomHub, their “About” page stipulates that they do not allow non-profit organizations to be targeted. Today’s report shows that it is either a lie, or they don’t have complete control of all of their affiliates. Targeted organizations should always remember that criminals lie.

Additional background on RansomHub:

• RansomHub: New Ransomware has Origins in Older Knight
• RansomHub Ransomware – What You Need To Know
• RansomHub Group Deploys New EDR-Killing Tool in Latest Cyber Attacks
• New research provides insight into RansomHub

For organizations that need to better understand how to defend against ransomware and other types of cyberattacks, are encouraged to utilize the resources below. If you are not currently receiving the daily ransomware report, and would like to, please consider joining the FB-ISAO as a member.

Additional Resources:

• CISA- Stop Ransomware
• CISA- Shields Up
• CISA- Cyber Essentials Toolkits