Hackers Admit Destroying InterContinental Hotels Group’s Data ‘For Fun’

The threat actors behind the InterContinental Resorts Group (IHG) cyber–attack documented before this month admitted doing it ‘for pleasurable.’

The hackers created the admission to the BBC in excess of the weekend, saying they are a couple from Vietnam who tried using to conduct a ransomware attack versus IHG and upon failing, decided to delete the information they experienced at first acquired.

“In this occasion, it, thankfully, appears like IHG was ready to protect against the attackers from deploying ransomware, but in retaliation, they deleted the knowledge they had accessed, placing the resort chain in a no–win predicament,” Jordan Schroeder, taking care of CISO at Barrier Networks, informed Infosecurity Magazine.

The risk actors identified as themselves ‘TeaPea,’ and mentioned they acquired initial entry to IHG units by using a effective phishing attack that tricked an staff into downloading malware via an email attachment and capturing their two–factor authentication (2FA) code.

They would have then accessed the most delicate areas of IHG’s laptop or computer techniques immediately after discovering login aspects for the firm’s inner password vault, with the password reportedly being ‘Qwerty1234.’

“Becoming ready to recuperate from unexpected gatherings quickly and easily have to also be a concentration. The stakes are significant, and there are basically no assures on the route an attacker will get or what they will conclusion up accomplishing,” Schroeder added.

“When it will come to defenses, these will have to incorporate excellent password techniques, but utilizing a password that is Qwerty1234 is not an case in point of this. Unfortunately, this password retains demonstrating up on ‘most–used passwords’ lists.”

An IHG spokeswoman afterwards advised the BBC that the password vault information were being not insecure but refused to provide details about how TeaPea managed to break into the lodge chain’s techniques.

“This goes to exhibit that resilience need to normally be the precedence. Halting attackers getting into programs have to be the emphasis simply because when they are in, corporations then have incredibly minimal regulate about what will take place to their facts future,” Schroeder mentioned.

“As an alternative, put into action potent, one of a kind passwords, apply MFA, use Privileged Obtain Management (PAM) to protect essential accounts, deploy layered security to protect against lateral movement, and prepare employees frequently on phishing and cybercrime.”

Nearly two weeks soon after the attack, IHG verified that customer–facing programs are now returning to normal but that some solutions could continue being intermittent.

Some parts of this article are sourced from:
www.infosecurity-magazine.com