Three ransomware gangs breached an automotive supplier in 2 weeks

LockBit, Hive, and ALPHV/BlackCat affiliates breached an automotive supplier’s systems within two weeks, with two of the attacks occurring within just two hours.

Before the automotive supplier was attacked by the ransomware strains, its security had been compromised by a likely initial access broker (JAB) in December 2022. The attack exploited a misconfiguration of the firewall to breach the domain controller server with a Remote Desktop Protocol (RDP) connection.

The vulnerability was exploited on May 1, after LockBit and Hive ransomware payloads were distributed over the network, whereby the legitimate PsExec and PDQ Deploy tools were used within two hours to encrypt more than a dozen systems during the attack.

In addition to encrypting files, the LockBit ransomware strain also stole and exfiltrated data to the Mega Cloud storage service.

Two weeks after the attack, a BlackCat attacker exploited the same flaw in the company’s management server to install the legitimate Atera Agent remote access solution.

The attackers gained persistence on the network, delivered ransomware payloads and exfiltrated stolen data.

The recovery attempts became complicated after the BlackCat affiliate erased evidence by deleting shadow copies and clearing out the Windows Event Logs on the compromised systems.

Businesses are advised to keep their systems up-to-date and check their environment for backdoors or bugs that attackers can introduce and help them regain access to a network after removal.

The sources for his piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web