lockbit3 attacks Heron Construction
Incident Date:
October 14, 2022
Overview
Title
lockbit3 attacks Heron Construction
Victim
Heron Construction
Attacker
Lockbit3
Location
First Reported
October 14, 2022
Heron Construction Targeted by Lockbit3 Ransomware Group
Heron Construction, a family-owned and operated marine construction company based in New Zealand, has been targeted by the ransomware group Lockbit3. The attack was announced on the group's dark web leak site, and the victim's website is heronconstruction.co.nz. Heron Construction specializes in marine dredging, providing accurate hydrographic surveys, and has been in operation since 1964.
Company Size and Industry Standing
Heron Construction is a medium-sized company with a long history in the construction sector. They have been providing dredging services for over 45 years and have completed numerous projects throughout New Zealand, Australia, and the South Pacific. Their expertise in marine dredging and hydrographic surveys sets them apart in their industry, making them a valuable asset for construction companies seeking quality dredging services.
Vulnerabilities and Targeting
The construction sector has seen a significant increase in ransomware attacks, with the highest count of attacks occurring from January 2022 to January 2023. Vulnerabilities in the industry stem from outdated systems and insufficient cybersecurity measures, making companies like Heron Construction susceptible to these malicious cyber events.
The Lockbit3 ransomware group is known for targeting various industries, including construction, and has been active since at least 2022. The group's tactics include encrypting data and threatening to release it unless a ransom is paid.
Mitigation Strategies
To mitigate the risk of ransomware attacks, companies should implement robust cybersecurity measures, such as installing updates and patches, providing comprehensive employee training, and using preventive software. Backing up important data on separate devices can also help lessen the impact of a ransomware attack.
In addition, cyber insurance can provide a safety net for construction businesses in the event of a ransomware attack, covering expenses related to data recovery, system restoration, legal costs, and potential losses due to business interruption.
The construction sector faces a growing threat from cybercriminals, and companies like Heron Construction must remain vigilant to protect their operations from ransomware attacks. By implementing comprehensive cybersecurity measures and considering cyber insurance, construction businesses can better safeguard themselves against these malicious cyber events.
Sources
- Heron Construction - Official Website
- Ransomware Attacks in Construction - Horton Group https://www.thehortongroup.com/resources/ransomware-attacks-in-construction
- Ransomware Continues to Take Down Business: Event Breakdown - Secureworks https://www.secureworks.com/blog/ransomware-continues-to-take-down-businesses
- The EVIL-ution of Ransomware 2.0 - Rodney Heron's Post - LinkedIn https://www.linkedin.com/pulse/evil-ution-ransomware-20-rodney-heron/
- Ransomware Is Crippling the Construction Industry - Construction Business Owner https://www.constructionbusinessowner.com/technology/ransomware-crippling-construction-industry
- Cyber Threat Group Profiles: Their Objectives, Aliases, and Malware - Secureworks https://www.secureworks.com/research/threat-profiles
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.