Flagship Group claims that after what it believes to have been a successful phishing assault, it was infected with the Sodinokibi ransomware.
The ransomware, according to Flagship, compromised certain private employee and customer data at an on-site data centre.
With the typical anonymous prominent independent cybersecurity firm, police, and the National Cyber Security Centre all looking into the breach simultaneously, the attack is believed to have been stopped in its tracks.
The best course of action is to refuse to pay the Sodinokibi/REvil gang's demanded ransom, according to threat analyst Brett Callow of the ransomware recovery company Emsisoft.
Source: https://www.theregister.com/2020/11/06/revil_sodinokibi_ransomware_gang_flagship_group_housing/
TPRM report: https://scoringcyber.rankiteo.com/company/flagship-housing-group-ltd
"id": "fla11544623",
"linkid": "flagship-housing-group-ltd",
"type": "Ransomware",
"date": "11/2020",
"severity": "100",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'name': 'Flagship Group', 'type': 'Organization'}],
'attack_vector': 'Phishing',
'data_breach': {'type_of_data_compromised': ['private employee data',
'customer data']},
'description': 'Flagship Group was infected with the Sodinokibi ransomware '
'after a successful phishing assault, compromising certain '
'private employee and customer data at an on-site data centre.',
'impact': {'data_compromised': ['private employee data', 'customer data'],
'systems_affected': ['on-site data centre']},
'initial_access_broker': {'entry_point': 'Phishing'},
'investigation_status': 'Under Investigation',
'motivation': 'Financial',
'ransomware': {'ransom_paid': 'No', 'ransomware_strain': 'Sodinokibi'},
'recommendations': ['Refuse to pay the demanded ransom'],
'references': [{'source': 'Emsisoft'}],
'response': {'law_enforcement_notified': 'police',
'third_party_assistance': 'independent cybersecurity firm'},
'threat_actor': 'Sodinokibi/REvil gang',
'title': 'Flagship Group Ransomware Attack',
'type': 'Ransomware'}