Cactus Ransomware Group Targets Sofidel UK, Compromises 74GB Data
Incident Date:
June 18, 2024
Overview
Title
Cactus Ransomware Group Targets Sofidel UK, Compromises 74GB Data
Victim
Sofidel UK
Attacker
Cactus
Location
First Reported
June 18, 2024
Ransomware Attack on Sofidel UK by Cactus Group
Company Profile: Sofidel UK Limited
Sofidel UK Limited, a subsidiary of the Italian-based Sofidel Group, is a prominent player in the global tissue paper market. Known for its commitment to sustainability and innovation, the company manufactures a variety of tissue products including toilet paper and kitchen towels. With a focus on environmental responsibility, Sofidel UK employs advanced manufacturing technologies to ensure both efficiency and quality in its production processes. The company's dedication to sustainable practices and high-quality products distinguishes it in the tissue paper industry.
Details of the Ransomware Attack
The Cactus ransomware group recently targeted Sofidel UK Limited, resulting in the exfiltration of 74GB of sensitive data. This breach compromised personal identifiable information, financial documents, and corporate correspondence. The attack not only threatens the privacy of employees and customers but also poses significant operational and reputational risks for Sofidel UK, which boasts an estimated revenue of $3 billion.
Profile of the Cactus Ransomware Group
The Cactus ransomware group, known for its sophisticated cyber-attacks, operates as a ransomware-as-a-service (RaaS). This group has been active since March 2023, exploiting vulnerabilities such as the ZeroLogon to infiltrate organizations globally. Cactus distinguishes itself through unique encryption techniques and the use of malvertising lures to deploy their ransomware, making them a formidable threat in the cybersecurity landscape.
Potential Vulnerabilities and Attack Vectors
Sofidel UK's significant digital footprint and extensive data repositories may have made it an attractive target for the Cactus group. The ransomware could have penetrated the company’s systems through exploited vulnerabilities in network security, possibly compounded by inadequate endpoint defenses or phishing attacks. The group’s method of using custom scripts to disable security tools before deploying the ransomware suggests a highly sophisticated attack strategy, tailored to bypass conventional security measures.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.