SRP Federal Credit Union, a well-established financial institution in the United States, has reportedly become the latest victim of the Nitrogen ransomware group. The cybercriminals claim to have infiltrated the credit union’s systems, extracting 650 GB of sensitive data and are selling it for $400,000.
While specific details about the methods used to compromise SRP Federal Credit Union’s systems remain undisclosed, such attacks typically exploit vulnerabilities in network defences or rely on phishing schemes to gain access.
The specific details of the breach are still unknown. However, when financial institutions experience a breach, sensitive information such as customer records, transaction details, and internal communications is often compromised. If this data is misused, it can have serious consequences for both the customers and the institution.
SRP serves over 195,000 members and has over $1.6 billion in assets. Founded in 1960, it provides saving programs, checking accounts, loan options, and other financial services. The institution also operates more than 50 Automatic Teller Machines (ATMs), making it a viable option for cyber attacks.
Nitrogen ransomware emerged in 2023. The group relies on malvertising to lure victims to malicious websites, which host trojanised malware that can infiltrate a victim’s system.
Once the malicious software is executed, NitrogenStager is installed on the computer, establishing communication with the command-and-control (C2) servers that are exfiltrating the data.
Furthermore, the websites associated with the Nitrogen ransomware disguise themselves as legitimate IT tools, including TreeSize Free, AnyDesk, WinSCP, and Cisco AnyConnect. Victims often struggle to distinguish between authentic and malicious sites, leading them to fall prey to the ransomware attack.
Banks and financial institutions have become a target for cybercriminals. In October, an Interbank data breach exposed 3.7 TB of data belonging to more than three million users.
In India, a ransomware attack on C-Edge affected more than 300 small and medium banks. A few months before that, Evolve Bank and Trust confirmed the Lockbit data breach, which affected more than 7.6 million people.
In the News: OpenAI unveils Google-rival SearchGPT search engine
