Royal ransomware group’s offshoot targets US’ ZooTampa

ZooTampa, one of the United States’ most popular zoos, became a subject of a cybercriminal attack involving stealing employee and vendor information. Based on reports, the attackers claiming responsibility for the attack could be an offshoot of the notorious Royal ransomware group.

Moreover, ZooTampa recently confirmed the attack after discovering a data breach incident that affected its network infrastructure. Fortunately, after detecting the incident, the zoo immediately took swift action and contacted its third-party security provider.

The third-party service provider allegedly aided the zoo in securing the network environment and investigating the scope of the unwanted attack on its systems. In addition, the affected entity has already notified relevant federal law enforcement agencies about the attack.

The organisation has also contacted employees and vendors whose information was lost during the data breach incident.

 

ZooTampa clarified that the attack had not reached critical information.

 

A ZooTampa representative assured everyone that the attack did not acquire personal or financial information about daily visitors or members since they do not store such data.

Numerous researchers believe that the zoo became an attractive entity for malicious actors since it is in the process of raising funds for a $125 million renovation project in December. The representative did not release any more details about the attack.

On the other hand, the BlackSuit ransomware group claimed the cybercriminal attack against ZooTampa. Based on reports, the Blacksuit ransomware group is a relatively new cybercriminal organisation that emerged last May and has already posted three victims to its extortion website.

Additionally, numerous researchers claimed that this cybercriminal group could be an affiliate of the Royal ransomware group.

Royal is a cybercriminal organisation that has recently infected several states in the United States. Their most recent campaign is the headline-grabbing attacks on the city of Dallas. According to experts, BlackSuit and Royal also have ties to the now-defunct Conti ransomware group, which disbanded last June and spread into several new malicious entities.

A cybersecurity expert explained that while the BlackSuit group is new, the operators are likely experienced and adept at attacking different entities since they have already worked with Conti and other ransomware strains.