First detected in early 2024, FunkSec is a new and fast-evolving ransomware group that combines data theft with unusual extortion tactics, including public leaks on social media and underground forums.
Victims of FunkSec find their data encrypted and stolen, with a ransom note demanding payment in cryptocurrency. If the victim refuses, FunkSec often publishes stolen data on public channels to increase reputational and legal pressure.
A break-in at your offices would compel you to call the police immediately and touch nothing until they arrive, understanding the need for a forensic investigation.
A cyber-attack requires the same action. Your first responsibility would be to call in the forensic experts and ensure the environment remains untouched.
This is not a job for your IT team or MSP. There are Digital Forensic specialists available 24/7 who can assist you.
FunkSec is believed to be operated by a small but highly agile cybercrime group, known for its unpredictable targeting and quick adaptation to new vulnerabilities. Unlike some groups that target only large enterprises, FunkSec attacks a broad range of organisations, from small businesses to global brands.
FunkSec is a cybercriminal group that escalates privileges and disables security tools as part of its attack methodology. One of the distinguishing features of FunkSec is its reliance on artificial intelligence to assist in the development of ransomware and other malware suites. These tools are made available through its darknet site, demonstrating a sophisticated and evolving threat model.
The group exfiltrates sensitive company and customer data before encrypting files with a .funk extension. If ransom demands are not met, FunkSec threatens to publish the stolen data and ransom notes across multiple leak channels, increasing pressure on the victims to comply.
Originally rooted in hacktivism, FunkSec has developed tools for launching Distributed Denial of Service (DDoS) attacks. It is now blending its ideological motivations with financial extortion, actively encouraging attacks against organizations located in the United States, India, and Israel. This shift reflects a broader trend of hacktivist groups adopting more profit-driven strategies.
Their ransom notes often use informal, mocking language, adding psychological pressure to force victims to pay quickly.
They use a double extortion strategy: first encrypting data and then exfiltrating it. FunkSec is particularly notorious for dumping stolen files on both dark web leak sites and open social media platforms - sometimes tagging the victim's brand accounts to ensure maximum embarrassment.
FunkSec is still a relatively young group but has already been linked to 172 confirmed attacks across industries including retail, media, and technology.
Cybersecurity analysts warn that FunkSec’s use of public shaming via social media sets it apart from many other ransomware operations, creating additional urgency for organisations to secure their systems.
Solace Cyber’s track record includes hundreds of successful response recoveries, providing Digital Forensic Incident Response services, 24x7x365.
“The NCSC handled 430 significant cyber incidents in 2024, a 16% increase from the previous year.”
Solace Global was founded in 2010 as global experts in risk management and security, offering services such as Travel, Crisis, and Offshore Risk Management. With a 24/7 Security Operations Centre and an in-house intelligence team providing daily and weekly reports, Solace Global is accredited to ISO 27001, 14001, 45001, and 9001 standards.
Solace Cyber was established in 2021, specialising in Cyber breaches, particularly Digital Forensics and Incident Response, Ransomware, Risk Management, and Information Security, along with Managed Security Services. The leadership team collectively possess over 20 years of experience in the IT and security industry.
Solace Cyber is accredited to ISO 27001 and, in 2022, achieved recognition as an Assured Service Provider for Cyber Incident Response (CIR) at the Standard Level with the National Cyber Security Centre. This prestigious accreditation reflects the UK's highest cyber security standards, ensuring top-tier incident response support and recovery.
s
%+
A forensic analysis needs to be meticulous and a clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:
Solace Cyber was established precisely for this scenario. We have a well-defined process for handling cyber-attacks like FunkSec, which involves a 6-step approach:
It includes a thorough digital forensic analysis from step 2 where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:
It is critical that the analysis of digital evidence is carried out to an agreed plan. This will have been designed to provide the best and earliest chance of discovering a root cause, which is essential to inform remediation/eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.
Solace’s Digital Forensic and Incident Response teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident, delivering successful business recovery.
Solace Cybers' assistance extends beyond recovery. After restoring your business operations, we work collaboratively to ensure your cyber security posture is robust using a threat-informed methodology. This involves leveraging our comprehensive 9-step framework known as the Solace Global - Cyber 9 Step Process.
Yes, FunkSec is a ransomware operation that encrypts victims' data and uses double extortion - demanding payment to decrypt files and to prevent public leaks of stolen data.
FunkSec commonly uses:
To protect your business:
The average cost of ransomware breaches hover around £500K, while smaller email data breaches typically incur expenses of around £50K. A critical decision emerges between preserving the environment for forensic analysis or opting for swift recovery to minimise business disruption. Delays in identifying and resolving breaches only exacerbate costs.
Cybersecurity insurance claims entail a multifaceted process, encompassing reasonable expenditures for investigation and remediation, alongside coverage for legal, business interruption, criminal liability, employment liability, and ransom policies. While the insurance industry plays a pivotal role in facilitating business recovery, cyber insurance is perceived as volatile within the sector, and many policies require meticulous validation.
Facing genuine pressure, there's a crucial decision to make - one that could rescue your organisation from weeks of operational standstill, reputation damage, and client data loss. Yet, the probability of a favourable outcome remains slim, emphasising the importance of engaging a specialised ransomware incident response team. They are your most viable recourse for navigating a ransomware incident.
The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home
Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.
The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets
Yes. There's a possibility that some of the lost data contains "Personal Data" belonging to your customers. Safeguarding such data is a legal requirement, so it's important to consider notifying the Information Commissioner's Office (ICO) about this incident, as well as your customers. https://ico.org.uk/
Your insurer or legal counsel will provide guidance on the necessary steps and how to proceed in this matter. However, Solace Cyber has experience collaborating with insurers and legal representatives and can offer assistance in managing these relationships during this challenging period.
Your business operations may experience significant disruptions. These could include:
To mitigate these effects, it's crucial to have a comprehensive incident response plan in place, including communication strategies, collaboration with cybersecurity experts, and measures to enhance system resilience and data protection. Additionally, transparency with stakeholders and proactive steps to rebuild trust can help minimize the long-term consequences on your business.
The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.
As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Solace Cyber provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.
Action Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Action Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.
If your systems are showing signs of an FunkSec attack, REMAIN CALM.
YOU MUST NOT TOUCH THEM, RESTORE OR OVERWRITE THE DATA (explanation above).
Contact Solace Cyber on 01202 308818 or complete our form for a call back from one of our experts.
We will act promptly to reduce your business downtime.
Solace Cyber, part of Solace Global, helps companies across the UK recover from ransomware attacks and data breaches.
SOLACE GLOBAL CYBER LTD is registered in England & Wales no. 08830710
Solace Global
Twin Sails House,
W Quay Rd,
Poole, BH15 1JF
United Kingdom
