Major Payment Disruption: Ransomware Strikes Indian Banking Infrastructure

Description

CloudSEK's threat research team uncovered a ransomware attack impacting banks and payment providers in India. The attack, initiated through a compromised Jenkins server at Brontoo Technology Solutions, is attributed to the RansomEXX ransomware group. This sophisticated threat actor employs tactics like phishing, exploiting vulnerabilities, and using legitimate tools for lateral movement. The group exfiltrates data before encryption for double extortion and demands significant ransom payments, often negotiating based on the victim's perceived ability to pay. The attack highlights supply chain vulnerabilities and the need for robust cybersecurity practices across critical vendors and ecosystems.