Bulldog Bag Ltd. Targeted in Ransomware Attack by Underground Team
Incident Date:
May 4, 2024
Overview
Title
Bulldog Bag Ltd. Targeted in Ransomware Attack by Underground Team
Victim
Bulldog Bag Ltd
Attacker
Underground Team
Location
First Reported
May 4, 2024
Ransomware Attack on Bulldog Bag Ltd by Underground Team
Company Profile
Bulldog Bag Ltd., based in Langley, British Columbia, Canada, is a prominent player in the flexible packaging industry with over 50 years of experience. Specializing in custom printed flexible packaging products, the company employs 143 individuals and reports an annual revenue of $20.6 million. Bulldog Bag Ltd. is recognized for its high-quality customer service and product offerings, which include biodegradable materials and water-based inks, underscoring their commitment to environmental sustainability.
Details of the Ransomware Attack
The cybercrime group known as Underground Team targeted Bulldog Bag Ltd., compromising their operational integrity by deploying ransomware. The attack resulted in the exfiltration of 91.7 GB of sensitive data, including employee details, contracts, and financial records. This data was subsequently published on the dark web, posing significant privacy and security risks to the company and its stakeholders.
Attack Vector and Ransomware Characteristics
Underground Team ransomware is known for its sophisticated attack methodologies, which include the use of a 64-bit GUI application capable of executing several malicious commands. These include deleting backups, modifying registry settings, and halting critical services like MSSQLSERVER. The ransomware typically identifies system volumes using API functions and disseminates a ransom note across multiple system folders, selectively encrypting files while excluding certain filenames, extensions, and directories.
The primary infection vector for this ransomware is believed to involve advanced social engineering tactics. Phishing emails with malicious attachments or links to compromised websites are commonly used to deceive victims into initiating the ransomware. These emails are crafted to appear legitimate, often mimicking familiar entities to lure users into downloading malicious payloads disguised as software updates or legitimate applications.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.