Halliburton Ransomware (Aug 2024): RansomHub Hit US Oilfield Services Giant

Incident summary

Halliburton, the world's second-largest oilfield services company, disclosed a cybersecurity event on August 21, 2024. Per the company's SEC Form 8-K filed August 22, 2024, an unauthorized third party gained access to Halliburton systems, prompting the company to shut down certain IT systems and engage outside cyber advisors and law enforcement. The August 28, 2024 8-K amendment confirmed that the actor had also exfiltrated data prior to deploying ransomware. Halliburton's Q3 2024 Form 10-Q, filed in late October 2024, recorded an approximately $35 million pre-tax impact and stated that the event reduced earnings by about 2 cents per diluted share for the quarter.

Public reporting from Reuters on August 28, 2024 and Bloomberg on August 23, 2024 attributed the intrusion to RansomHub, a ransomware-as-a-service group active since early 2024 and the subject of CISA joint advisory AA24-242A issued August 29, 2024. The CISA advisory documented RansomHub as a successor operation that absorbed affiliates from ALPHV and LockBit following their respective disruptions. The Halliburton intrusion was one of the largest publicly disclosed RansomHub victim engagements in the calendar year.

Operational disruption included billing systems and customer-facing platforms used by exploration and production customers. Halliburton stated in its August 28 8-K that operations on customer well sites were not directly affected, but back-office and invoicing functions ran in degraded mode for weeks. The $35 million pre-tax impact captured remediation costs, lost revenue from delayed billing, and incident response expense. The company did not publicly disclose whether a ransom was paid.

Attack technique

Per CISA advisory AA24-242A on RansomHub TTPs, the affiliate playbook combines initial access via valid accounts (T1078), exploitation of public-facing applications (T1190) where unpatched edge infrastructure is available, and post-compromise exfiltration to attacker-controlled cloud storage (T1567.002) before deploying file encryption (T1486). RansomHub affiliates frequently obtain initial access through credential broker purchases on Russian-language forums and through phishing campaigns targeting privileged users. The Halliburton initial access vector has not been publicly confirmed, but the August 28 8-K language is consistent with valid-credential entry rather than a software supply chain compromise.

Post-compromise, RansomHub affiliates typically establish persistence using legitimate remote access tools including AnyDesk, ConnectWise ScreenConnect, and Atera, all of which are commonly present in enterprise environments and produce low-fidelity EDR signals. Affiliates then run reconnaissance with built-in Windows commands and Active Directory tools, identify high-value file shares, and exfiltrate data to Mega.io or similar cloud storage. Encryption is deployed last, often during off-hours, using a RansomHub binary that disables volume shadow copies and backup catalogs to inhibit recovery (T1490).

The Halliburton 8-K language indicates Halliburton detected the intrusion and proactively shut down affected systems before full domain-wide encryption was complete. That timing matters analytically. RansomHub affiliates often spend days to weeks inside a target network before the encryption event, and detection during that dwell window can substantially reduce the encryption footprint and the actor's negotiating position. Halliburton's stated multi-week recovery timeline is consistent with partial encryption plus full network rebuild from clean baselines.

Impact and consequences

The direct financial impact disclosed in Halliburton's Q3 2024 10-Q was approximately $35 million pre-tax, with earnings reduced by about 2 cents per diluted share for the quarter. That figure captures remediation expense, lost revenue from billing system downtime, and the cost of forensic and recovery work. The figure does not include any ransom payment, which Halliburton did not confirm or deny in public filings. The relative size of the impact, against Halliburton's roughly $5.5 billion quarterly revenue, illustrates that even a single ransomware event at a Fortune 200 industrial company produces a measurable but not existential financial outcome.

The sector-level impact is the strategic story. Halliburton provides drilling, completion, and production services across roughly 70 countries. The August 2024 intrusion landed during a period of heightened US Department of Energy and CISA focus on oil and gas sector cyber resilience, following the Colonial Pipeline incident in 2021 and the subsequent TSA security directives on pipeline operators. Halliburton's intrusion extended that focus from pipelines to upstream services. The CISA RansomHub advisory issued one week after the Halliburton disclosure cited the energy sector as a particular focus of RansomHub affiliate targeting.

Customer-side impact extended beyond Halliburton's own balance sheet. Major exploration and production customers including ExxonMobil, Chevron, and ConocoPhillips relied on Halliburton's billing and operations platforms for downstream reconciliation. Weeks of degraded billing functionality produced reconciliation backlog at customer accounts payable teams. No public customer disclosed a material impact, but the operational friction at the customer side was widely reported in industry press through September 2024.

Regulatory consequence followed. The SEC's July 2023 cybersecurity disclosure rule, which took effect December 2023, requires public companies to disclose material cybersecurity incidents on Form 8-K within four business days of materiality determination. Halliburton's August 22, 2024 8-K, filed roughly 24 hours after the August 21 detection, became one of the early reference disclosures under the new rule. The two-step disclosure pattern, initial 8-K followed by an amendment with additional detail, set a market precedent that other large public companies followed in subsequent incidents.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

Detection during dwell time, not perfect prevention, is the realistic defensive posture against RansomHub-class affiliates. Halliburton's August 21 detection and proactive shutdown sequence, before full domain-wide encryption, materially reduced the encryption footprint and recovery time. Build detection capability that fires on the pre-encryption indicators: anomalous AnyDesk or ScreenConnect sessions on production servers, mass file enumeration from non-admin workstations, and outbound traffic to Mega.io or similar cloud storage from server-class hosts. Reference CISA advisory AA24-242A for the specific RansomHub indicator set.

Backup integrity is the recovery control. RansomHub binaries disable volume shadow copies and backup catalogs (T1490) as standard practice. Online backups accessible from compromised domain credentials are within the actor's reach. Offline, immutable, or air-gapped backup copies with independent authentication are the only backup tier reliably available after a full domain compromise. The Halliburton multi-week recovery timeline indicates partial reliance on offline backup tiers, which is the realistic enterprise pattern.

SEC 8-K cybersecurity disclosure cadence is now a board-level operational requirement, not a legal afterthought. The four-business-day clock starts at materiality determination, and the materiality assessment process needs to be pre-defined before an incident. Halliburton's 24-hour turnaround from detection to initial 8-K was achievable because the company had a pre-built materiality assessment process. Build that process now, document it, and exercise it in tabletop drills. The first 8-K an organization files under an active incident is not the time to discover that the process does not exist.

Sector-level coordination is increasingly the operational reality. CISA's RansomHub advisory was issued one week after the Halliburton disclosure and incorporated indicators from multiple oilfield services and energy sector victims. Participate in sector-specific information sharing through the Oil and Natural Gas ISAC, the Electricity ISAC, or the relevant sector ISAC for your industry. The sector-level intelligence that flows through ISACs is faster and more actionable than waiting for CISA advisories, which lag the active campaign by weeks.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /careers/incident-responder
• /careers/soc-analyst
• /careers/threat-intelligence-analyst
• /careers/ot-ics-security-engineer

Related Decipher Files

• Change Healthcare Ransomware (Feb 2024): ALPHV via Unprotected Citrix
• Snowflake Breaches 2024: Ticketmaster, AT&T, Santander Hit via Customer-Side Credentials
• Colonial Pipeline DarkSide: When OT Met Ransomware-as-a-Service

Frequently asked questions