Cactus Ransomware Attack on Dollmar S.p.A.
Incident Date:
June 2, 2024
Overview
Title
Cactus Ransomware Attack on Dollmar S.p.A.
Victim
Dollmar SPA
Attacker
Cactus
Location
First Reported
June 2, 2024
Ransomware Attack on Dollmar S.p.A.
Company Overview
Dollmar S.p.A. has established itself as a European leader in the distribution of industrial chemicals, offering high-quality products and services for over 70 years. The company excels in the production and distribution of chemical products for industrial use, catering to industries such as automotive, metalworking, electronics, and pharmaceuticals.
Company Standout
What sets Dollmar S.p.A. apart in the industry is its extensive range of industrial chemicals, including pure raw materials, chemical specialties, and solvents for surface treatment. They provide tailor-made formulations and maintain a strong focus on sectors such as the pharmaceutical industry, mechanical industry, polyurethane processing, PVC processing, inks, paints, sealants, and adhesives.
Company Size
With a workforce of 51 employees, Dollmar S.p.A. has a significant presence in Italy, demonstrating its influence and reach in the region.
Company Vulnerabilities
Given that Dollmar S.p.A. deals with sensitive chemical products and industrial solutions, the company is a prime target for threat actors due to the valuable nature of their intellectual property and trade secrets. Moreover, their involvement in various industries makes them an attractive target for cybercriminals aiming to disrupt operations and extort ransom payments.
Attack Overview
The Cactus ransomware group recently targeted Dollmar S.p.A.'s website, leaking sensitive data belonging to the company. The compromised data includes confidential corporate information, technical files, internal communications, financial documents, employee personal files, and database backups. This breach poses significant risks to the company's trade secrets, financial security, and employee privacy.
Ransomware Group Profile
Operating as a ransomware-as-a-service (RaaS), the Cactus ransomware group is notorious for exploiting vulnerabilities and utilizing malvertising lures for their targeted attacks. They employ unique encryption techniques to avoid detection and have been observed targeting organizations across various industries.
How the Ransomware Group Penetrated
The penetration of Dollmar S.p.A.'s systems by the Cactus ransomware group likely occurred through vulnerabilities in their network infrastructure or by exploiting weaknesses in their cybersecurity defenses. The group's use of custom scripts to disable security tools and distribute ransomware highlights their sophisticated understanding of cyber threats, enabling them to evade detection and execute successful attacks.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.