Elutia Targeted: BlackBasta Ransomware Breach

Incident Date:

June 7, 2024

World map

Overview

Title

Elutia Targeted: BlackBasta Ransomware Breach

Victim

Elutia

Attacker

Blackbasta

Location

Silver Spring, USA

Maryland, USA

First Reported

June 7, 2024

BlackBasta Ransomware Attack on Elutia

Overview of Elutia

Elutia, formerly known as Aziyo Biologics, is a commercial-stage biotechnology company specializing in regenerative medicine and advanced biomaterials. The company focuses on developing innovative products designed to improve patient outcomes in cardiology, orthopedics, and soft tissue repair. Elutia's core expertise lies in creating biologic solutions that integrate seamlessly with the human body to promote healing and tissue regeneration. The company is headquartered in Silver Spring, Maryland, and trades on the Nasdaq exchange under the ticker symbol ELUT.

Details of the Attack

The ransomware group BlackBasta executed a ransomware attack on Elutia, claiming responsibility for the breach. The attackers reported exfiltrating over 550GB of data, including employee personnel files, corporate data related to finance, payroll, and human resources, as well as tax forms, passports, and other personal and confidential documents. Additionally, research and development documents were stolen, with some folders labeled "Aziyo", "Development", "Clinical Research", "Customer Service", "FDA", "Finance", and "InstronData."

About BlackBasta

BlackBasta is a ransomware operator and Ransomware-as-a-Service (RaaS) criminal enterprise that emerged in early 2022. The group is believed to have connections to the defunct Conti threat actor group. BlackBasta targets organizations in highly targeted attacks, employing a double extortion tactic by encrypting critical data and threatening to publish sensitive data on their public leak site if the ransom is not paid. The group uses sophisticated methods for initial access, lateral movement, and data exfiltration, including spear-phishing campaigns, insider information, and exploiting vulnerabilities.

Penetration and Vulnerabilities

BlackBasta likely penetrated Elutia's systems through a combination of spear-phishing campaigns and exploiting vulnerabilities within the company's network. The group's use of tools like QakBot, Mimikatz, and Cobalt Strike Beacons for lateral movement and credential harvesting suggests a highly sophisticated attack. Elutia's focus on advanced biomaterials and regenerative medicine, coupled with the sensitive nature of their research and development data, made them an attractive target for the ransomware group.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.