lockbit2 attacks CCL
Incident Date:
February 13, 2022
Overview
Title
lockbit2 attacks CCL
Victim
CCL
Attacker
Lockbit2
Location
First Reported
February 13, 2022
CCL, a Global Construction Firm, Suffers Ransomware Attack by Lockbit2
CCL, a global construction firm with over 80 years of experience and operations across five continents, has recently fallen victim to a ransomware attack orchestrated by the notorious group Lockbit2. This incident was publicly disclosed on the group's dark web leak site, which has since been taken down by law enforcement agencies, including the FBI and the UK National Crime Agency (NCA).
Renowned for its specialized engineering techniques, CCL has been instrumental in delivering iconic construction projects worldwide. The company prides itself on its commitment to innovation, quality, and meticulous attention to detail, ensuring optimal solutions for every project undertaken.
Despite its significant global footprint and diverse project portfolio, specific details regarding CCL's size and financials remain undisclosed. Lockbit2, the group behind this cyberattack, is recognized for its extensive history of ransomware operations. With ties to Eastern Europe, Russia, and China, Lockbit2 operates a ransomware-as-a-service model, renting its malicious software to affiliates who then carry out attacks and share a portion of the proceeds from ransom payments.
This attack on CCL is indicative of a larger trend, as ransomware attacks continue to plague various sectors, including healthcare, manufacturing, and education. The ransomware economy is flourishing, with cybercriminals extorting an unprecedented $1.1 billion in ransom payments from their victims in 2023 alone.
While the specific vulnerabilities exploited in the attack on CCL have not been disclosed, ransomware attacks typically leverage known software or hardware vulnerabilities or employ social engineering tactics to infiltrate systems.
The recent seizure of Lockbit2's dark web site by the FBI and its international partners marks a significant blow to the group's operations. This action is part of a concerted effort by law enforcement to dismantle ransomware groups and safeguard potential victims.
The ransomware attack on CCL serves as a stark reminder of the persistent cyber threats facing businesses and organizations globally. Although the full details of the attack remain under wraps, it highlights the critical importance of implementing robust cybersecurity measures and maintaining vigilance to fend off such threats.
Sources
- CCL - Specialised Engineered Solutions for Structures
- CNN - FBI and allies seize dark-web site of world's most prolific ransomware group
- SOCRadar.io - Dark Web Profile: Play Ransomware
- CISA - Official Alerts & Statements
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.