HELLCAT Ransomware Group Exploits Jira Infostealer Credentials To Target Major Companies

The HELLCAT ransomware group has intensified its cyberattacks, compromising four major organizations—HighWire Press, Asseco Poland, Racami, LLC, and LeoVegas Group—by exploiting stolen Jira (Atlassian) credentials obtained through Infostealer malware. The attackers exfiltrated sensitive internal files and financial records, deploying extortion tactics with countdown timers.

This follows HELLCAT’s prior breaches at Jaguar Land Rover, Orange, and Schneider Electric, all traced to Infostealer-harvested credentials. Proactive Infostealer monitoring could mitigate such risks.

Read the full analysis: https://lnkd.in/d4eq5VwF
Learn how to protect your organization: www.hudsonrock.com

You Should Know: Detecting and Preventing Infostealer Attacks

1. Identify Infostealer Activity

Use these commands to detect credential theft:

Linux:

grep -r "jira" /home//.config/ /home//.local/share/  Search for stolen Jira creds
journalctl -u ssh --no-pager | grep "Failed password"  Check SSH brute-force attempts

Windows (PowerShell):

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625} | Select-Object -First 10  Failed logins

2. Secure Jira/Atlassian Instances

Enforce MFA:

Use Atlassian API to enforce MFA (example):
curl -u admin:password -X PUT -H "Content-Type: application/json" -d '{"enabled": true}' https://your-jira-instance/rest/api/2/mfa

Block Suspicious IPs:

iptables -A INPUT -s 123.456.789.0/24 -j DROP  Replace with attacker IP range

3. Monitor for Data Exfiltration

Detect Large Outbound Transfers:

iftop -i eth0  Real-time network traffic monitoring
netstat -anp | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c  Active connections

4. Ransomware Mitigation

Isolate Infected Systems:

systemctl stop smbd nmbd  Stop Samba shares if compromised

Restore from Backups:

rsync -avz /backup/ /home/  Example restore command

What Undercode Say

HELLCAT’s reliance on Infostealers underscores the critical need for credential hygiene. Key takeaways:
1. Log Auditing: Regularly check `/var/log/auth.log` (Linux) or Event Viewer (Windows) for anomalous logins.
2. Network Segmentation: Use iptables/nftables to restrict lateral movement.
3. Endpoint Detection: Tools like `chkrootkit` or `rkhunter` can identify malware persistence.
4. Windows Hardening: Disable WScript with reg add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d 0 /f.

Expected Output: A hardened infrastructure with active Infostealer monitoring and automated alerting on credential leaks.