LockBit 3.0 Ransomware Strikes Craig Steven Development
Incident Date:
June 5, 2024
Overview
Title
LockBit 3.0 Ransomware Strikes Craig Steven Development
Victim
Craig Steven Development.
Attacker
Lockbit3
Location
First Reported
June 5, 2024
LockBit 3.0 Ransomware Attack on Craig Steven Development
Overview of Craig Steven Development
Craig Steven Development Corporation, based in Northbrook, Illinois, is a real estate development company known for its expertise in creating community retail shopping centers. The company has developed over four million square feet of property, including retail, office, industrial, and residential projects across the Chicago metropolitan area and other select markets. With a revenue of approximately $6 million and a small team of 2 to 25 employees, Craig Steven Development stands out for its tenant satisfaction and strategic property development.
Details of the Ransomware Attack
The LockBit 3.0 ransomware group, also known as LockBit Black, executed a ransomware attack on Craig Steven Development. The attack resulted in the leakage and subsequent publication of sample-sized data on the group's dark web leak site. This incident highlights the vulnerabilities of small to mid-sized companies in the real estate sector, which may lack robust cybersecurity measures, making them attractive targets for sophisticated ransomware groups.
About LockBit 3.0 Ransomware Group
LockBit 3.0 is an advanced variant of the LockBit ransomware, emerging in 2022. Known for its modular and evasive nature, LockBit 3.0 operates under a Ransomware-as-a-Service (RaaS) model, allowing affiliates to use their malware for attacks. The group has been actively targeting a wide range of businesses and critical infrastructure organizations globally, including major companies like Boeing and the US division of the Chinese bank ICBC. LockBit 3.0 encrypts files, modifies filenames, and drops a ransom note, making it a formidable threat in the cybersecurity landscape.
Potential Penetration Methods
While specific details of how LockBit 3.0 penetrated Craig Steven Development's systems are not disclosed, common methods include exploiting vulnerabilities in software, phishing attacks, and leveraging weak or compromised credentials. The ransomware's ability to move laterally through networks and delete traces of itself further complicates detection and mitigation efforts.
Sources
- Craig Steven Development Corporation
- LinkedIn - Craig Steven Development
- LinkedIn - Craig Steven Development Corp.
- RocketReach - Craig Steven Development Corp.
- SignalHire - Craig Steven Development Corp.
- ZoomInfo - Craig Steven Development Corp.
- VMware - LockBit 3.0
- SentinelOne - LockBit 3.0
- TrendMicro - LockBit 3.0
- Times of India - LockBit 3.0
- Wazuh - LockBit 3.0
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.