Valencia Ransomware Group Targets Multiple Global Organizations

A new ransomware operation referred to as Valencia Ransomware has recently made headlines by leaking sensitive information purportedly stolen from various organizations worldwide. The group has utilized their dark web site, known as the “Wall of shame,” to post gigabytes of downloadable data claimed to be exfiltrated from several entities, including a Californian municipality, a pharmaceutical corporation, and a paper manufacturer.

Among the asserted victims is the City of Pleasanton in California, where Valencia Ransomware alleges the theft of 283GB of sensitive information. Other organizations reportedly affected include Malaysian pharmaceutical firm Duopharma Biotech with 25.7GB, Indian paper manufacturer Satia with 7.1GB, and Bangladeshi drug maker Globe Pharmaceuticals with 200MB of compromised data. Additionally, there are accusations that Spanish fashion company Tendam has also suffered an attack by the group, marking an unfortunate recurrence as the firm was allegedly targeted by Medusa ransomware earlier this month.

Speculation has arisen suggesting a potential link between some of the attacks executed by the Valencia group and vulnerabilities found in the WhatsUp Gold network monitoring software from Progress. These vulnerabilities, which could allow cybercriminals to seize control of WhatsUp Gold admin accounts, were responsibly disclosed in May, with proof-of-concept exploit codes made public by the end of August. Security firms alerted that the exploit was being actively utilized by cybercriminals within hours of its release.

On the Valencia group’s leak site, the compromised organizations are marked with the statement: “Here is a list of companies that don’t care about customer privacy.” This statement, however, refers to companies that have chosen not to comply with the ransom demands following the cyberattack.

While paying the ransom can further incentivize cybercriminals and heighten the likelihood of subsequent attacks, many organizations face a difficult decision when considering the potential implications for their business operations and the well-being of employees, partners, and clients. It remains essential for affected entities to report such cyber incidents to law enforcement and aid in investigations.

Despite the increasing financial gains that ransomware attacks continue to generate, there remains little indication of a decline in their occurrence. Organizations are urged to adopt measures to prevent potential ransomware infections and ensure robust cybersecurity defenses.