ElDorado Ransomware Attack Exposes Tankerska Plovidba's Data
Incident Date:
June 6, 2024
Overview
Title
ElDorado Ransomware Attack Exposes Tankerska Plovidba's Data
Victim
Tankerska Plovidba d.d.
Attacker
ElDorado
Location
First Reported
June 6, 2024
ElDorado Ransomware Attack on Tankerska Plovidba d.d.
Overview of Tankerska Plovidba d.d.
Tankerska Plovidba d.d. is a Croatian maritime shipping company specializing in the transportation of liquid and dry bulk cargoes. Established in 1955 and headquartered in Zadar, Croatia, the company operates a fleet of modern vessels designed to meet global shipping demands. They focus on the safe, efficient, and environmentally responsible transport of crude oil, petroleum products, chemicals, and dry bulk commodities such as grains, coal, and iron ore. The company emphasizes operational excellence, sustainability, and crew well-being, making it a reputable player in the maritime industry.
Details of the Ransomware Attack
Recently, the ransomware group ElDorado has claimed responsibility for an attack on Tankerska Plovidba d.d., resulting in the exfiltration of 1.7TB of private company data. This data is now up for sale on ElDorado's dark web leak site. The attack has significantly impacted the company's operations, given the sensitive nature of the exfiltrated data.
About ElDorado Ransomware Group
ElDorado is a ransomware group that emerged in 2024, known for its double-extortion tactics. They encrypt victims' files and exfiltrate sensitive data, threatening to release it publicly if ransom demands are not met. Over the past seven months, the group has claimed 15 victims, showcasing their aggressive and sophisticated approach. They use phishing attacks, exploit unpatched vulnerabilities, and leverage weaknesses in Remote Desktop Protocol (RDP) configurations to infiltrate systems.
Penetration and Impact
The ransomware group's meticulous targeting involves thorough reconnaissance to identify valuable data within a company's network. In the case of Tankerska Plovidba d.d., the group likely exploited vulnerabilities in the company's cybersecurity defenses, possibly through phishing or unpatched software. This attack underscores the critical need for robust cybersecurity measures, especially for companies in the transportation sector, which are integral to the global supply chain.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.