HKCERT Warns of Ransomware Attacks on Local Institutions, Urges Education Sector to Strengthen Defenses

The Hong Kong Cybersecurity Incident Coordination Centre (HKCERT) recently issued a warning, urging local businesses and educational institutions to enhance their cybersecurity vigilance. Following last week's ransomware group Orova's intrusion into local enterprises, another group known as "The Gentlemen" has also targeted various industries. Recent reports indicate that Hong Kong Baptist University (HKBU) has been listed on their dark web leak site, suggesting it may have fallen victim to a ransomware attack.

Analysis of Recent Ransomware Activities

HKCERT's analysis indicates that recent ransomware incidents have involved the theft of account credentials or the failure to enable multi-factor authentication, showing that attackers are increasingly inclined to use legitimate accounts for intrusions rather than traditional malware attacks. Although investigations are ongoing, this highlights the persistent threat of ransomware and the security risks associated with authentication. Organizations should review their cybersecurity status and defense measures.

Preventive Measures and Recommendations

HKCERT recommends that the public and businesses adopt the following preventive measures:

• Do not reuse passwords; use unique and strong passwords for important accounts.
• Enable multi-factor authentication (MFA), prioritizing anti-phishing verification methods.
• Regularly check for leaked account credentials and unusual login activities.
• Enhance employee and user awareness of phishing, social engineering, and account security.
• Regularly review and update all external services, cloud platforms, and third-party applications.
• Establish offline and offsite backup strategies, and conduct regular restoration drills.

HKCERT emphasizes that with the increasing prevalence of cloud services and remote work models, credentials have become a primary target for cybercriminals. Organizations must regularly check account security and fully implement protective measures such as multi-factor authentication.

If a ransomware attack is suspected, affected systems should be immediately isolated, and HKCERT should be contacted for assistance. Detailed defense recommendations can be found in HKCERT's security advisory.