LockBit Ransomware Attack on Plant Machine Works: Comprehensive Analysis and Impact
Incident Date:
July 19, 2024
Overview
Title
LockBit Ransomware Attack on Plant Machine Works: Comprehensive Analysis and Impact
Victim
Plant Machine Works
Attacker
Lockbit3
Location
First Reported
July 19, 2024
LockBit Ransomware Attack on Plant Machine Works: A Detailed Analysis
Overview of Plant Machine Works
Plant Machine Works, Inc., located in Baton Rouge, Louisiana, is a full-service machine shop specializing in precision machining and repair services for rotating equipment. With over 40 years of experience, the company has built a strong reputation for excellence in servicing and manufacturing mechanical parts across various industries, including oil and natural gas, petrochemical, chemical, agriculture, food manufacturing, and alternative energy. Operating from a 62,000-square-foot facility, the company employs approximately 24 people and generates an annual revenue of about $13.7 million.
Services and Technological Capabilities
The company offers a wide range of services, including rotating equipment repair, custom manufacturing of mechanical components, preventative maintenance, and storage solutions for frequently needed replacement parts. Their advanced technological capabilities, such as the 5-axis Mazak Integrex Machining Center and various CNC machines, enable them to meet evolving customer expectations with precision and efficiency. Plant Machine Works is ISO 9001 accredited, underscoring their commitment to quality.
Details of the Ransomware Attack
On July 19, 2024, Plant Machine Works fell victim to a ransomware attack orchestrated by the LockBit group. The attack was publicly claimed on LockBit's dark web leak site. While the full extent of the data leak remains unknown, the incident has raised significant concerns given the company's critical role in providing turn-key machining and fabrication services. The breach highlights the growing threat of ransomware attacks on industrial and manufacturing sectors.
About LockBit Ransomware Group
LockBit, also known as LockBit Black, is a highly sophisticated ransomware-as-a-service (RaaS) group active since September 2019. It has become the most active ransomware group, responsible for over one-third of all ransomware attacks in the latter half of 2022 and the first quarter of 2023. LockBit employs "double extortion" tactics, exfiltrating sensitive data and threatening to release it publicly if the ransom is not paid. The ransomware uses a combination of RSA-2048 and AES-256 encryption algorithms to encrypt victims' files and typically demands payment in Bitcoin.
Potential Vulnerabilities and Penetration Methods
LockBit is designed to exploit vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network. It performs a check to avoid executing on computer systems with installed languages common to the Commonwealth of Independent States (CIS) region. Indicators of Compromise (IOCs) for LockBit include the creation of a mutual exclusion object (Mutex) when executed, the use of a unique icon, and changes to the victim's computer wallpaper. The ransomware group distinguishes itself by its modular design, which encrypts its payload until execution to hinder malware analysis and detection.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.