LockBit3 Ransomware Hits TCC Group: Maritime Sector Cyber Threat
Incident Date:
July 25, 2024
Overview
Title
LockBit3 Ransomware Hits TCC Group: Maritime Sector Cyber Threat
Victim
TCC Group
Attacker
Lockbit3
Location
First Reported
July 25, 2024
LockBit Ransomware Group Targets TCC Group in Maritime Sector Attack
Overview of TCC Group
TCC Group, officially known as Tai Chong Cheang Steamship Co. (H.K.) Limited, is a significant entity in the maritime industry. Founded in 1917 by C.S. Koo in Shanghai, the company has evolved from a customs brokerage into a leading shipowner and ship management firm. Headquartered in Hong Kong, TCC Group operates a global network with offices in key maritime hubs such as Singapore, Tokyo, New York, and Manila. The company manages a diverse fleet, including oil tankers and dry bulk carriers, and is involved in comprehensive vessel management, including logistical support, maintenance, and regulatory compliance.
Attack Overview
The ransomware group LockBit has claimed responsibility for a cyberattack on TCC Group. The attack was announced on LockBit's dark web leak site, where the group threatened to publish the compromised data on August 1, 2024, if their demands are not met. To substantiate their claims, LockBit released sample screenshots of the compromised data. This incident highlights the increasing threat of ransomware attacks in the maritime sector, emphasizing the need for enhanced cybersecurity measures.
Details of the Ransomware Group
LockBit is a sophisticated ransomware-as-a-service (RaaS) group active since September 2019. It has become one of the most active ransomware groups, responsible for a significant portion of ransomware attacks in recent years. LockBit employs "double extortion" tactics, exfiltrating sensitive data and threatening to release it publicly if the ransom is not paid. The ransomware uses a combination of RSA-2048 and AES-256 encryption algorithms to encrypt victims' files and typically demands payment in Bitcoin.
Potential Vulnerabilities and Penetration Methods
LockBit is known for exploiting vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network. The ransomware also performs checks to avoid executing on systems with languages common to the Commonwealth of Independent States (CIS) region. Indicators of Compromise (IOCs) for LockBit include the creation of a mutual exclusion object (Mutex) when executed, the use of a unique icon, and changes to the victim's computer wallpaper. The group accepts various command-line parameters to modify its behavior, such as spreading laterally via group policy or admin shares and rebooting into Safe Mode.
Implications for TCC Group
The attack on TCC Group underscores the vulnerabilities within the maritime sector, particularly for companies with extensive international operations and significant digital infrastructure. TCC Group's commitment to innovation and sustainability, while commendable, also necessitates robust cybersecurity measures to protect against sophisticated threat actors like LockBit. The potential exposure of sensitive data could have far-reaching implications for the company's operations and reputation.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.