Golden Business Machines Hit by Play Ransomware: Key Details
Incident Date:
July 25, 2024
Overview
Title
Golden Business Machines Hit by Play Ransomware: Key Details
Victim
Golden Business Machines, Inc. (GBM)
Attacker
Play
Location
First Reported
July 25, 2024
Ransomware Attack on Golden Business Machines, Inc. by Play Ransomware Group
Overview of Golden Business Machines, Inc. (GBM)
Golden Business Machines, Inc. (GBM) is a well-established provider of office technology solutions, including copiers, printers, managed IT services, and document management systems. Founded in 1969 by Joseph R. Bradley, GBM is headquartered in Kingston, Pennsylvania, and serves a wide range of industries across Northeastern and Central Pennsylvania, as well as the Lehigh Valley. The company employs between 51 and 200 individuals and generates an estimated revenue of $10 million to $25 million annually. GBM is known for its personalized service and strong partnerships with leading technology providers like Canon and Microsoft.
Details of the Ransomware Attack
GBM recently fell victim to a ransomware attack orchestrated by the Play ransomware group. The attack targeted GBM's computer networking solutions, compromising their network infrastructure and potentially exposing sensitive data. The perpetrators encrypted critical files and demanded a ransom for their release, significantly disrupting GBM's operations and posing substantial challenges to their business continuity.
About the Play Ransomware Group
The Play ransomware group, also known as PlayCrypt, has been active since June 2022 and has been responsible for numerous high-profile attacks. Initially focusing on Latin America, the group has expanded its operations to North America, South America, and Europe. Play ransomware targets a diverse range of industries, including IT, transportation, construction, materials, government entities, and critical infrastructure. The group is known for using various methods to gain entry into networks, such as exploiting RDP servers, FortiOS vulnerabilities, and Microsoft Exchange vulnerabilities.
Attack Methods and Penetration Techniques
Play ransomware employs several sophisticated techniques to penetrate and compromise systems. They use scheduled tasks and PsExec for execution and persistence, and tools like Mimikatz for privilege escalation. The group also employs defense evasion tools to disable antimalware and monitoring solutions. In the case of GBM, the attackers likely exploited vulnerabilities in the company's network infrastructure, possibly through reused or illicitly acquired VPN accounts or unpatched software vulnerabilities.
Impact on GBM and Industry Implications
The ransomware attack on GBM has had a significant impact on the company's operations, highlighting the vulnerabilities that medium-sized businesses face in the current cybersecurity landscape. GBM's reliance on managed IT services and document management systems made it an attractive target for the Play ransomware group. The incident underscores the importance of continuous monitoring, timely patching of vulnerabilities, and the implementation of advanced security measures to protect against such sophisticated cyber threats.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.