Halliburton: RansomHub ransomware behind the attack?

The ransomware gang RansomHub is behind the recent cyberattack on Halliburton.

The attack caused widespread disruption, with the company forced to shut down its IT systems and disrupt business operations. Customers were reportedly unable to create invoices or purchase orders.

Halliburton disclosed the attack last Friday in a filing with the SEC, stating that the cyberattack took place on August 21, 2024.

“ On August 21, 2024, Halliburton Company (the “Company”) became aware that an unauthorized third party had gained access to certain of its systems ,” Halliburton’s filing read

See also: Iranian hackers Pioneer Kitten collaborate with ransomware groups

«When the Company became aware of the matter, it activated its cyber response plan and initiated an investigation internally, with the support of external consultants, to assess and remediate the unauthorized activity.».

The company provides numerous services to oil and gas, including those involved in well construction, drilling, fracking, as well as software and IT companies. Due to the company's wide range of services, there is a lot of connectivity between them and their customers. However, the company did not share details about the attack and the potential impact on customers. As a result, many customers have disconnected from Halliburton due to the failure to share information.

According to BleepingComputer, some companies are working with ONG-ISAC, a service that acts as a central point of coordination and communication for physical threats and cybersecurity against the oil and gas industry, to obtain technical information about the Halliburton attack to determine if they were affected.

RansomHub ransomware behind the attack

For days, there were rumors that the ransomware gang RansomHub was behind the attack on Halliburton.

The company did not respond to the rumors. However, in an email on August 26, Halliburton told BleepingComputer that it had taken the systems offline to protect them and was working with Mandiant to investigate the incident.

He also stated that email systems continue to function as they are hosted on Microsoft Azure. A solution for trading and placing purchase orders is also available.

See also: BlackByte ransomware exploits VMware ESXi vulnerability

The email also includes a list of IOCs with filenames and IP addresses associated with the attack that customers can use to identify similar activity on network . One of these IOCs is for a Windows executable file named maintenance.exe, which, according to BleepingComputer, shows encryption by the RansomHub. After analyzing the sample, it appears to be a newer version of the ransomware.

The RansomHub ransomware operation began in February as a group that stole data and threatened to sell it online. However, ransomware encryptors have also been discovered to be used in double-ransomware, where hackers breach networks, steal data, and encrypt files.

This ransomware attack on Halliburton shows that taking preventive measures is essential to protect companies and ordinary users:

Back up your data: One of the most effective ways to protect yourself from a  attack  is to regularly back up your data. This ensures that even if your data is encrypted by ransomware, you will have a safe copy that can be restored without paying the ransom.

Update your operating system and software: Out-of-date operating systems and software are vulnerable to cyberattacks. It is important to regularly update your devices with the latest  security  and software updates to prevent any vulnerabilities that could be exploited by ransomware.

Beware of suspicious emails and links: Ransomware attacks often start with a phishing email or malicious link. It is important to be cautious when opening emails from unknown senders. Also, do not click on suspicious links. These could lead to ransomware being installed on your device.

Use antivirus software:  Installing reputable antivirus software on your devices can help you detect and prevent  attacks  . Be sure to update your antivirus software regularly to ensure it is equipped to handle new threats.

See also: Qilin ransomware: Steals credentials from Chrome browser

Education: One of the most important steps to protect against ransomware is education. It is important to stay up to date on the latest types of ransomware and how they work. Organizations should also train their employees on how to identify and avoid potential attacks.

Implement strong passwords: Weak or easy passwords can make it easier for hackers to gain access to your devices and install ransomware. It's important to use strong and unique passwords and enable two-factor authentication whenever possible.

Use a VPN: A VPN encrypts your internet connection and provides an extra layer of security against ransomware attacks. This is especially important when using public Wi-Fi networks, which are often unsecured and vulnerable to cyberattacks.

Source: www.bleepingcomputer.com