Visualização de leitura

UK Cybercrime Journal: Beacon CRM Breach Impacts Over 1,500 Charities

@BushidoToken Threat Intel

Por:BushidoToken

4 de Novembro de 2026, 07:00

What Happened

In late July 2026, Beacon CRM, a UK-based customer relationship management platform serving over 1,500 non-profit and charitable organisations, suffered a major supply chain cyber incident that resulted in the unauthorised exfiltration of its database backups.
The compromise began around 27 July 2026, when the unknown attackers gained initial access by leveraging an AWS access key that was inadvertently exposed in publicly accessible JavaScript build artifacts.
Over a two-day period of 27–28 July, the attacker used these credentials to download full database backups containing records from over 1,000 UK charity customers.
Beacon CRM detected the unauthorised activity on 29 July, revoked the exposed credentials, and began notifying affected organisations between 30 July and 3 August. Public announcements and regulatory notifications followed, including press releases from the UK Charity Commission.
While payment card numbers and live bank details were not stored within the affected Beacon CRM database, exported backups included names, email addresses, phone numbers, home addresses, donation histories, and uploaded attachments (including Gift Aid declarations and user notes).
Several charities noted that historical records and data previously requested for deletion were retained within stored system backups, exposing older records belonging to past donors and service users.

An example list of charities who publicly stated they were impacted by the Beacon CRM breach is as follows:

The Robert Burns Ellisland Trust (here)
Lincoln Cathedral and Magna Vitae (here)
English National Ballet (here)
Yorkshire's Brain Tumour Charity (here)
The Sheffield Hospitals Charity (here)
The Shrewsbury and Telford Hospital Charity (here)
The Molly Rose Foundation (here)
The British Deaf Association (here)
The Message Trust (here)
The London Irish Centre (here)
Saint Catherine’s Hospice (here)
LawCare (here)

Analyst Comment

The Beacon CRM incident highlights the severe operational and reputational leverage inherent to single-point SaaS vendor dependencies in the non-profit sector. Non-profits heavily lean on SaaS providers due to resource constraints. When a centralised vendor suffers a credential breach, it creates a cascading effect across hundreds of downstream organisations that lack dedicated in-house cybersecurity teams.

Hardcoded and leaked API credentials, such as AWS access keys in this case, via client-facing build files remains a high-impact, easily preventable vulnerability class. Static secret-scanning tools and secrets management solutions should prevent raw production keys from ever reaching public JavaScript deployment packages. Unfortunately, this attack vector continues to be effective as other organisations such as Arup Group and Manchester Airports Group were also targeted by FulcrumSec using the same method.

While direct financial theft via credit cards was avoided, the exfiltrated dataset (names, donation history, Gift Aid details, home addresses) provides ideal conditions for social engineering, phishing, and targeted identity fraud directed at donors and vulnerable service users.

Defensive Takeaways

Automate Secret Scanning in CI/CD Pipelines: Implement continuous integration (CI) repository scanners (such as GitGuardian, Trufflehog, or AWS Secrets Manager tools) to detect and block access keys, API tokens, and secret strings before deployment to build artifacts.
Strict Identity & Access Management (IAM) Scoping: Restrict AWS keys using least-privilege principles. Access keys utilised by application or build layers should never have global or elevated permissions allowing direct read/export access to full infrastructure backups or AWS S3 buckets containing raw database snapshots.
Third-Party SaaS Incident Response Planning: This case highlights the importance of maintaining up-to-date inventories of third-party processors and sensitive data classifications. Ensure contractual SLAs specify rapid incident notification timelines, and maintain actionable response plans to satisfy the UK ICO's 72-hour reporting rule upon vendor disclosure.
Credential Rotation & Session Invalidation: Immediately rotate integrated API keys, webhooks, and Single Sign-On (SSO) tokens connected to third-party software platforms following an upstream compromise notification.

Relevant Sources

Relevant CTI Sources

https://www.sans.org/blog/hunting-saas-threats-insights-for589-course-cybercriminal-campaigns

Tracking Adversaries: EvilCorp, the RansomHub affiliate

@BushidoToken Threat Intel

Por:BushidoToken

2 de Abril de 2025, 12:52

Introduction

This blog is part of a cyber threat intelligence (CTI) blog series called Tracking Adversaries that investigates prominent or new threat groups.

The focus of this blog is EvilCorp, a sanctioned Russia-based cybercriminal enterprise known for launching ransomware attacks, and RansomHub, a prominent ransomware as a service (RaaS) operation run by Russian-speaking cybercriminals.

These two threat groups have been linked together through cooperation on intrusions and IOCs and TTPs shared by multiple CTI sources. The implication of this link is critical due to RansomHub being the most active ransomware gang and is working with a well-known sanctioned affiliate.

Who is RansomHub?

Active since February 2024, RansomHub is a RaaS operation formerly known as Cyclops and Knight and is run by Russian-speaking adversaries. It is currently used by more and more cybercriminals that are ex-affiliates of other RaaS operations. This includes the ALPHV/BlackCat RaaS and the LockBit RaaS, which have since shutdown or disappeared. This has made the RansomHub RaaS one of the most widespread ransomware families as of early 2025.

Due to having a high number of affiliates, the tools and TTPs observed before the final RansomHub payload is deployed can vary significantly. Each affiliate may have their own set of tools and TTPs to achieve the final objectives of data exfiltration and ransomware deployment.

Who is EvilCorp?

Evil Corp is an international cybercrime network sanctioned for orchestrating large-scale financial cyberattacks led by Maksim Yakubets. EvilCorp’s operations have evolved over time, expanding from Dridex banking trojan campaigns into developing ransomware like BitPaymer, WastedLocker, Hades, PhoenixLocker, and MacawLocker.

Notably, Aleksandr Ryzhenkov, was identified by the National Crime Agency (NCA) as a high-ranking member of EvilCorp and also LockBit affiliate. Ryzhenkov became a LockBit affiliate around 2022, contributing to over 60 LockBit ransomware builds and attempting to extort more than $100 million from victims. This discovery aligns with Mandiant’s previous reporting on EvilCorp shifting to LockBit as well.

The NCA also found that EvilCorp maintains close ties with Russian intelligence agencies through Yakubets' father-in-law, Eduard Bendersky, a former FSB officer, who is suspected of using his influence to shield the group from prosecution in Russia.

One of the TTPs that makes EvilCorp standout from the rest of the RaaS affiliates is their own affiliation to the SocGholish JavaScript malware (aka FAKEUPDATES). If ransomware deployment takes place following a SocGholish infection, then the attackers responsible for the attack will be affiliated with EvilCorp.

Reported Connections Between EvilCorp and RansomHub

On 15 July 2024, Microsoft shared a post on X stating that RansomHub was observed being deployed in post-compromise activity by Manatee Tempest (which is Microsoft’s name for EvilCorp) following initial access via SocGholish (aka FakeUpdates) infections (which Microsoft tracks as Mustard Tempest).

A screenshot of a computer

AI-generated content may be incorrect.

On 15 January 2025, Guidepoint wrote a blog on a new Python backdoor used by an affiliate of RansomHub. Notably, the new Python backdoor was delivered by SocGholish. Therefore, this Python backdoor is another potential artifact worth monitoring for its connection to known EvilCorp-related malware.

The next day, on 16 January 2025, Google shared a report on EvilCorp (which Google tracks as UNC2165) that disclosed numerous tools and malware families they have been using to deliver RansomHub, including a Python backdoor dubbed VIPERTUNNEL (see the image below). The presence of a Python backdoor following a SocGholish infection is notable TTP that overlaps with the Guidepoint blog on RansomHub.

On 14 March 2025, Trend Micro disclosed further details that also confirmed the SocGholish malware is leading to the deployment of RansomHub ransomware. The operators of SocGholish are tracked as Water Scylla by Trend Micro. The operators distribute SocGholish via the Keitaro Traffic Direction System (TDS), a legitimate service used for marketing campaigns. Trend Micro also observed SocGholish dropping the same custom Python backdoor (aka VIPERTUNNEL) as well.

So What?

EvilCorp has been under US sanctions since 2019, making it illegal for affected organisations to pay ransoms to them without facing potential fines from the US Treasury’s Office of Foreign Assets Control (OFAC). Despite these sanctions, EvilCorp has continued its cybercriminal activities by adapting its tactics to include rebranding their ransomware and becoming an affiliate of RaaS operations, such as LockBit and RansomHub.

The key indicator of EvilCorp's involvement in ransomware attacks continues to be the use of the SocGholish malware, which employs drive-by downloads masquerading as web browser software updates to gain initial access to systems.

EvilCorp’s affiliation with RansomHub raises the possibilities that RansomHub may soon face sanctions similar to those imposed on EvilCorp. Consequently, any victim that pays a ransom to RansomHub could become significantly riskier for cyber insurance organisations, incident responders, and ransomware negotiators, as they may inadvertently violate sanctions and face legal repercussions.

Given EvilCorp's prominence as a target for international law enforcement, its association with RansomHub is likely to draw increased scrutiny. This could result in RansomHub becoming the focus of future law enforcement actions, including potential takedowns and additional sanctions, further complicating the landscape for entities involved in ransomware response and mitigation.

There is also the increased likelihood that RansomHub will now rebrand. As we saw in the BlackBasta Leaks, ransomware groups pay close attention to the news, CTI reports, and even posts on X and even blogs by researchers. This association to EvilCorp and threat of sanctions is an issue for ransomware groups as it impacts their business model and makes earning harder. Therefore, by linking the two entities together CTI analysts can impose cost on these cybercriminals.

References: