Threat Intelligence Brief
Curated summary with source attribution
Source: ransomware.live
Threat Risk: High
Victim: IHG Hotels & Resorts
Incident: Large-scale data exfiltration and unauthorized infrastructure access.
Impact: Exposure of customer PII, financial records, loyalty data, and critical cloud infrastructure keys.
Attacker: Unidentified ransomware group
Analysis: The breach appears to have originated from a critically weak LDAP binding password, enabling attackers to move laterally through the network. The compromise is severe, with reported access to AWS keys and CyberArk, which suggests the attackers gained deep administrative control. The scope spans several high-profile brands including Holiday Inn, Crowne Plaza, and Six Senses.
Recommendations: Enforce strong, unique passwords and mandatory MFA for all LDAP and administrative service accounts.; Immediately rotate all AWS access keys and audit CyberArk logs for unauthorized credential access.; Perform a comprehensive hunt for persistence mechanisms to ensure attackers cannot easily re-enter the network.
Source: Ransomware.live
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source