According to National Attack Surface (NAS) it was found that Confidence Group of Companies Limited, a prominent Bangladeshi tech conglomerate, has become a target of the rapidly growing RansomHub ransomware group. RansomHub, a new Ransomware-as-a-Service (RaaS) operation, is suspected to be an updated and rebranded version of the older Knight ransomware. Although no data has been breached yet, RansomHub typically releases stolen information after a specified countdown. Currently, there are 5 days, 21 hours, 22 minutes, and 45 seconds left before the potential breach of 350GB of data.
The exact nature of the stolen data and the specific servers that were compromised remain unknown. Confidence Group of Companies Limited, founded in 1991, plays a vital role in mid-tech manufacturing in Bangladesh, including sectors such as cement production, power generation, and the manufacture of Spun Pre-stressed Concrete poles. The conglomerate, consisting of eight operational business entities, is chaired by Rezaul Karim, with Imran Karim serving as Vice-Chairman.
NAS has further discovered that Since February 2024 RansomHub has already victimized 315 companies worldwide, marking it as a serious and growing global cybersecurity threat. Analysis by Symantec (part of Broadcom) reveals that RansomHub shares a high degree of similarity with Knight ransomware, indicating that Knight may have been the foundation for its development. However, Knight’s original creators are not believed to be behind RansomHub, as Knight’s source code was sold on underground forums after the group’s shutdown earlier this year. It is likely that other actors purchased and enhanced the code before launching RansomHub.This incident highlights the growing ransomware threat to Bangladeshi companies, and organizations should take urgent steps to protect their systems. National Attack Surface (NAS) will continue to monitor and report on these threats to safeguard Bangladesh’s cybersecurity infrastructure.
