Cyber security company Mandiant has found one in seven double-extortion ransomware attacks are leaking sensitive information that could provide access to physical systems.
The company found data stolen from ransomware victims related to operational technology (OT) systems, which are responsible for managing physical processes ranging from manufacturing equipment to energy distribution.
Data discovered included usernames and passwords for OT systems, IP addresses, remote services, asset tags, original equipment manufacturer (OEM) information, operator panels, and network diagrams.
This information, available for anyone to download from the dark web, renders companies more valuable to attack.
"Data from extortion leaks may provide sophisticated actors with information on targets, while limiting their exposure to defenders and cost of operations," the company said, adding that they can use it to makes it easier to launch more precise attacks with a higher impact.
In the study, Mandiant employees downloaded information stolen from ransomware victims and uploaded to 'shaming' sites after victims refused to pay up.
The company identified 1,300 extortion leaks released by ransomware groups in 2021 involving companies likely to use OT systems. It downloaded 70 of these leaks and analyzed the dumps looking for sensitive information.
Data discovered included in-depth network and process documentation for two oil and gas companies, including diagrams and spreadsheets. Mandiant's team also found names, user privileges, and passwords for IT, plant maintenance, and operations employees at a hydroelectric energy company.
Even file sets that did not contain critical OT data often contained administrative data spanning employees, finance, customers, and legal documentation, the company said.
Mandiant used its own publicly available FlareVM Windows-based penetration testing and malware analysis virtual machine for the analysis, along with Autopsy, an open-source tool for digital forensics.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
OT attacks are rife, according to recent research. In November, Skybox Security revealed that 83% of critical infrastructure companies have suffered at least one OT-related cyber breach in the last three years.
Last month, the Federal Bureau of Investigation (FBI), Cyber Security and Infrastructure Security Agency (CISA), and the National Security Agency (NSA) warned critical infrastructure companies to be on the lookout for attacks from Russia. The advisory detailed OT attacks as a particular danger.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
