Hotarus Corp gang hacked Ecuador’s Ministry of Finance and Banco Pichincha

‘Hotarus Corp’ Ransomware operators hacked Ecuador’s largest private bank, Banco Pichincha, and the country’s Ministry of Finance.

​A cybercrime group called ‘Hotarus Corp’ has breached the Ecuador’s largest private bank, Banco Pichincha, and the local Ministry of Finance (the Ministerio de Economía y Finanzas de Ecuador).

The group claims to have also stolen data from the Banco Pichincha bank and infected a system at Ministry of Finance using for training purposes with PHP-based ransomware.

An alleged member of the @HotarusCorp leaked on a hacking forum a link to a file containing 6500 records (Email, Identity Card numbers, and passwords) that claims to Ministry of Finance.

A member claim to be @HotarusCorp on a #leak forum claiming to have #data of Ministry of #Finance of #Ecuador

Member posted a #mega link which has txt file with 6500 records – Email, Identity Card numbers and passwords.#breach #infosec #deepwebnews@FinanzasEc @EcuCERT_EC

— Security Chronicle (@SecurChronicle) February 23, 2021

The bank published an official statement to confirm the security intrusion.

“We know that there was unauthorized access to the systems of a provider that provides marketing services for the Pichincha Miles program. In relation to this information leak, and based on an extensive investigation, we have found no evidence of damage or access to the Bank’s systems and, therefore, the security of our clients’ financial resources is not compromised.” reads the statement.We know that, through a fraudulent email, the attacker sends communications on behalf of Banco Pichincha to some clients of said program in order to obtain information necessary to carry out illegitimate transactions. We remind our clients that we never request sensitive data such as: users, passwords, card or account data, via telephone, email, social networks or text messages.”

Security researcher Germán Fernández confirmed the compromise of the Equador’s Ministry of Finance via Twitter.

Leaked Hotarus Corp #Ransomware Tool

Rein Xceed (2020) [Modificada]
extensión .reinxceed
"Tienes que pagar 250 Dolares Americanos en BITCOINS"

Agregada al arsenal #DataLeak

— Germán Fernández (@1ZRR4H) February 26, 2021

Fernandez revealed that the PHP ransomware employed in the attack is Ronggolawe/AwesomeWare.

Análisis del "Ransomware" en PHP ->

Código fuente de Ronggolawe / AwesomeWare ->

Otro sitio comprometido por Hotarus Corp -> /

Google Dork para + sitios vulnerados ->
"This is a notice of ransomware."

— Germán Fernández (@1ZRR4H) February 24, 2021

The bank has confirmed the attack in an official statement but states that it was a hacked marketing partner and not their internal systems.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

try { window._mNHandle.queue.push(function (){ window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”); }); } catch (error) {} try { window._mNHandle.queue.push(function (){ window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”); }); } catch (error) {}

Pierluigi Paganini

(SecurityAffairs – hacking, Ecuador)

The post Hotarus Corp gang hacked Ecuador’s Ministry of Finance and Banco Pichincha appeared first on Security Affairs.

Read the full article at