Industrias Peñoles Hit by Akira Ransomware: Key Details
Incident Date:
August 1, 2024
Overview
Title
Industrias Peñoles Hit by Akira Ransomware: Key Details
Victim
Industrias Peñoles
Attacker
Akira
Location
First Reported
August 1, 2024
Ransomware Attack on Industrias Peñoles by Akira Group
Industrias Peñoles, a leading Mexican mining and metallurgical company, has recently fallen victim to a ransomware attack orchestrated by the Akira group. The attack was disclosed on July 30, 2023, with the company reporting unauthorized access to its computer systems and information. Despite the breach, Peñoles has assured stakeholders that its business units remain operational due to the implementation of backup and alternative systems.
About Industrias Peñoles
Established in 1887, Industrias Peñoles, S.A.B. de C.V., is one of Mexico's largest mining firms, specializing in the extraction and processing of minerals such as silver, gold, lead, and zinc. The company operates several mining facilities across Mexico, particularly in mineral-rich regions like Zacatecas and Durango. Peñoles is also involved in chemical production, including sodium sulfate, and has a significant presence in both domestic and international markets. The company is known for its commitment to sustainability and environmental responsibility, integrating ESG criteria into its operations.
Details of the Attack
The ransomware attack on Peñoles was claimed by the Akira group via their dark web leak site. Akira is a relatively new but rapidly growing ransomware family that emerged in March 2023. The group is known for targeting small to medium-sized businesses across various sectors, including manufacturing, technology, and telecommunications. Akira employs double extortion tactics, stealing data before encrypting systems and demanding a ransom for both decryption and data deletion.
Akira Ransomware Group
Akira distinguishes itself with a unique dark web leak site featuring a retro 1980s-style interface. The group is believed to be affiliated with the now-defunct Conti ransomware gang, sharing similarities in their code. Akira's tactics include unauthorized access to VPNs, credential theft, and lateral movement to deploy ransomware. They have also been observed using tools like RClone, FileZilla, and WinSCP for data exfiltration. In April 2023, Akira expanded its operations to target Linux-based VMware ESXi virtual machines in addition to Windows systems.
Vulnerabilities and Penetration
Industrias Peñoles' extensive operations and significant digital infrastructure make it a lucrative target for ransomware groups like Akira. The company's reliance on interconnected systems for mining, metallurgy, and chemical production could have provided multiple entry points for the attackers. The use of VPNs and potential lapses in credential management may have facilitated unauthorized access, allowing Akira to deploy their ransomware and exfiltrate sensitive data.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.