Internal documents leaked as Rhysida claims responsibility for British Library ransomware attack

High price demanded for British Library data

Victoria Kivilevich, director of threat research at security company KELA Cyber Threat Intelligence, said the price demanded by Rhysida for the British Library data was relatively high, but not the highest, which was 50 bitcoins for data stolen from Prospect Medical Holdings in August 2023.

“Rhysida group doesn’t always manage to sell the data they try to auction, as can be seen from looking at their website. For example, they recently tried to sell data stolen from Azienda Ospedaliera Universitaria Integrata di Verona for 10 bitcoins, but it is now publicly available on their website, indicating there were no buyers,” she said. 

An advisory note from the FBI and the US Cybersecurity and Information Structure Agency (CISA) last week said the malware, first identified in May 2023, is offered as ransomware as a service to criminal groups, which then share profits with the ransomware owners.

Hackers gain access through VPNs

Criminals typically gain access to infected computer systems by using known vulnerabilities, such as ZeroLogon.

Attackers have also compromised credentials to access virtual private networks (VPNs), particularly where organisations have failed to enable two-factor authentication by default.

Groups using the malware engage in “double extortion” by demanding a ransom payment to decrypt victims’ data and threatening to publish the data unless a ransom is paid.

Victims receive a PDF ransom note that provides each company attacked with a unique reference code and instructions to contact the group on the dark web.

Jim Walter, senior threat researcher at SentinelLabs, which has produced an analysis on Rhysida told Computer Weekly: “Some of their early, and notable, targeting included the Chilean Army. They have also hit government targets in Kuwait and the Dominican Republic.

“In addition to government entities, Rhysida has targeted organisations in the education and academic sectors, so an attack on the British Library is within the group’s purview,” he added.

Marcelo Rivero, senior malware research engineer at Malwarebytes, said Rhysida typically uses “living off the land” techniques to exploit network administration tools built into the Windows operating system. This allows attackers to evade detection by blending in with normal network activities.