DarkVault Ransomware Hits Lithuanian Space Tech Firm Nordspace
Incident Date:
June 10, 2024
Overview
Title
DarkVault Ransomware Hits Lithuanian Space Tech Firm Nordspace
Victim
Nordspace
Attacker
DarkVault
Location
First Reported
June 10, 2024
DarkVault Ransomware Attack on Nordspace
Overview of Nordspace
Nordspace, a Lithuanian company specializing in the design, development, and manufacturing of advanced space technologies, has become the latest victim of the DarkVault ransomware group. Known for their innovative solutions in satellite communications, space exploration, and Earth observation, Nordspace plays a significant role in advancing space technology. The company operates in the manufacturing sector, focusing on projects ranging from CubeSats to large-scale satellite constellations.
Company Profile
Nordspace is based in Lithuania and operates under the registered name "UTIISIB NordSpace" with a registration number of 305564463. The company has a subsidiary in Latvia, "Nordspace-Jurkalnes, SIA," which is currently in the process of liquidation. Nordspace has a paid capital of 352,800 EUR and is owned by Lithuanian citizens. The company is medium-sized, with a presence in multiple Baltic countries.
Details of the Attack
The ransomware group DarkVault claimed responsibility for the attack on Nordspace via their dark web leak site. The attack has compromised Nordspace's operations, which include building satellites for high-speed data transmission, developing technologies for space exploration, and designing Earth observation satellites. The exact method of penetration remains unclear, but it is likely that DarkVault exploited vulnerabilities in Nordspace's cybersecurity defenses.
About DarkVault Ransomware Group
DarkVault is a relatively new ransomware group that has quickly made a name for itself by emulating the design and tactics of the LockBit ransomware group. They have published data from 19 victims on their leak site as of April. DarkVault's use of the LockBit Black ransomware has led to speculation about a possible rebranding. The group's sophisticated approach and dark web operations make it challenging for authorities to track and counter their activities.
Potential Vulnerabilities
Nordspace's involvement in high-stakes projects like satellite communications and space exploration makes it an attractive target for ransomware groups. The company's reliance on advanced technologies and data transmission systems could have presented exploitable vulnerabilities. The attack underscores the importance of robust cybersecurity measures, especially for companies operating in critical sectors like space technology.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.