A new threat group has carried out its first ransomware attack , raising concerns about the ever-evolving cyber threat landscape. This troubling ransomware incident involves the Arkana Group (or Arkana Security) and WideOpenWest (WOW!), one of the largest cable and broadband providers in the US.
The alleged breach, first reported by vx-underground, reveals that Arkana gained access to over 403,000 customer accounts and took control of critical support infrastructure, including AppianCloud and the Symphonica system.
A few words about WideOpenWest
WideOpenWest, Inc. is one of the largest cable and broadband service providers in the United States and the eighth largest in the industry. Founded in 1996 and headquartered in Denver, Colorado, WideOpenWest, Inc. offers a variety of services to customers in several states.
See also: What you need to know about Ransomware-as-a-Service (RaaS)
Arkana Security: Ransomware attacks
Arkana Security is a new ransomware group that specializes in exploiting vulnerabilities in corporate systems. According to Onionsite, there are three main stages to the group's attacks: Ransom, Sale, and Leak. The main goal is extortion, so at each stage the attackers try to force victims to pay for the return of their compromised data. The group is believed to be linked to Russia.
Arkana Security – Ransomware: The stages of attack in detail
The group claims to initially notify affected companies of a data breach, giving them a period of time to secure their systems before the data is exposed (Ransom stage). If the victim does not act in time, Arkana sells the stolen data on the dark web. The hackers give victims a final chance to buy their data back, claiming that they will delete all copies and prevent further exposure (Sale stage). If the victim refuses, Arkana proceeds to publicly leak the data, threatening to damage the company’s reputation and causing financial losses and legal consequences (Leak stage). This phase is made worse by the creation of the so-called “Wall of Shame,” which the group uses to publicly shame companies that fail to address their security vulnerabilities.
The Arkana group's methods and tactics are very similar to those used by most ransomware gangs, but it is supposed to offer a "second chance" to companies before fully exploiting their vulnerabilities.
See also: Medusa Ransomware disables security tools with a malicious driver
WideOpenWest is the first victim of Arkana Security
New ransomware group Arkana has reportedly breached WideOpenWest's systems (WOW!). The attackers have published extensive details about the alleged breach, including sensitive customer data and internal access to the company.
The group claims to have gained significant access to WOW!'s infrastructure. Leaked material suggests that the hackers have compromised more than 403,000 customer accounts (usernames, passwords, security questions and service package details). They also say they have full control of WOW!'s Symphonica system, which they claim they can use to push malware to customer devices.
The group also reportedly infiltrated critical backend systems, such as AppianCloud, and gained access to its APIs, including those for authentication and transactions. According to socradar.io, “Arkana can thus manipulate backend code, change business logic, and modify data flows, including customer financial transactions, personal information, and billing records.” In addition, it could be possible to make unauthorized transactions, access customer accounts, and modify billing information.
The Arkana ransomware group also claims to be able to view sensitive data, such as Social Security Numbers (SSN), credit card information, and other Personally Identifiable Information (PII).
See also: Albabat ransomware now targets Linux and macOS
You can see the data that was breached (according to the hackers) here.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Arkana: Doxxing
Additionally, the Arkana group is said to have engaged in doxxing activities against the CEO of WideOpenWest and other senior executives. The attackers published sensitive personal information, including the CEO’s addresses, contact information , and social security number. In addition, the post revealed the names of several directors, key people responsible for investor relations and media relations, as well as the Chairman of the Board.
If this breach is true, WideOpenWest could face serious problems. Significant damage to the company's reputation could occur, and there could be legal and regulatory consequences.
Protection from ransomware attacks
- Implement multi-factor authentication (MFA) for all user accounts
- Enable firewall on all devices connected to your network
- Keep sensitive data encrypted
- Update all your devices and systems with the latest security patches
- Conduct regular security audits and penetration testing
- Use strong, unique passwords and change them regularly.
- Limit user access to only necessary systems and information
- Consider using solutions email security for additional protection against phishing attacks
- Have a recovery plan to quickly restore systems in the event of an attack
- Back up your data regularly
- Stay up to date on the latest ransomware trends and tactics used by attackers
Source: socradar.io
