Ransomware gang Alphv 'unlikely to be fussed' about law firm's injunction order

Wednesday, 14 June 2023 10:08

Ransomware gang Alphv 'unlikely to be fussed' about law firm's injunction order Featured

By Sam Varghese

Pixabay

An Australian law firm's bid to try and use a court injunction to prevent publication of material stolen during a ransomware raid is unlikely to have any effect on the attackers behind the intrusion, a security professional says.

Australian law firm HWL Ebsworth was hit by the Alphv ransomware gang earlier this year. The attackers released the first lot of stolen data, including passport copies and other documents, on the dark web on 2 June.

The company sent a message to the media on Tuesday — iTWire was not included — saying it had obtained an injunction from the Supreme Court of NSW which aims to prevent the attackers from making the stolen material public.

According to a report in The Age, HWL Ebsworth also claims the order prevents "media from reporting reporting any details from the data".

Brett Callow, a seasoned ransomware researcher with the New Zealand-based security firm Emsisoft, told iTWire that this was not the first time a ransomware victim had tried this tactic.

"New Zealand’s Waikato District Health Board and the Irish Health Service Executive are among the other organisations to have taken similar courses of action, and it’s a somewhat risky strategy," he said.

"On the one hand, the inunction may dissuade casual looky-loos from accessing the data and also stop reporters from using it as the basis for stories.

"On the other hand, it’s unlikely to stop Alphv from releasing the data and may actually provoke them into releasing it more quickly or distributing it more widely than they otherwise would.

"When US company Southwire obtained injunctions against the Maze ransomware group and its Web host, Maze started to release the data on a Russian cyber crime forum with a note inviting people to, 'Use this information in any nefarious ways that you want'.”

A report about the Southwire incident in The Wall Street Journal points out that legal experts had opined that such a tactic could help victims protect themselves from the legal fallout after a breach.

According to the Australian Cyber Security Centre, Alphv, which is also referred to as BlackCat or Noberus, was first detected in late 2021.

"[It is] related to previous ransomware variants BlackMatter and DarkSide, which was used in the attack on Colonial Pipeline in May 2021," it said.

"The operators of Alphv have reportedly sought to recruit former members of the BlackMatter, DarkSide and REvil groups, and several similarities have been identified between the tactics, techniques and procedures of both Alphv and BlackMatter ransomware actors."

HWL Ebsworth, which describes itself as "one of Australia's leading commercial law firms across key areas". has offices in Sydney, Canberra, Melbourne, Perth, Adelaide, Brisbane, Darwin, Hobart and Norwest.

Read 438 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here

GARTNER MARKET GUIDE FOR NDR 2022

You probably know that we are big believers in Network Detection and Response (NDR).

Did you realise that Gartner also recommends that security teams prioritise NDR solutions to enhance their detection and response?

Picking the right NDR for your team and process can sometimes be the biggest challenge.

If you want to try out a Network Detection and Response tool, why not start with the best?

Vectra Network Detection and Response is the industry's most advanced AI-driven attack defence for identifying and stopping malicious tactics in your network without noise or the need for decryption.

Download the 2022 Gartner Market Guide for Network Detection and Response (NDR) for recommendations on how Network Detection and Response solutions can expand deeper into existing on-premises networks, and new cloud environments.

DOWNLOAD NOW!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!