Play Ransomware Group Targets Brainworks Software, Compromises Sensitive Data

Incident Date:

June 12, 2024

World map

Overview

Title

Play Ransomware Group Targets Brainworks Software, Compromises Sensitive Data

Victim

Brainworks Software

Attacker

Play

Location

Wichita, USA

Kansas, USA

First Reported

June 12, 2024

Ransomware Attack on Brainworks Software by Play Group

Overview of Brainworks Software

Brainworks Software, founded in 1988 and headquartered in Central Islip, New York, specializes in providing advanced software solutions for the media and publishing industries. With over 30 years of experience, the company has installed its software at over 415 companies. Brainworks Software focuses on advertising sales, circulation management, and content management, aiming to enhance operational efficiency for newspapers, magazines, and other media outlets. The company employs approximately 40 people and has an estimated revenue of $16 million.

Details of the Ransomware Attack

The ransomware group Play has claimed responsibility for a recent attack on Brainworks Software. The attack compromised private and personal confidential data, client documents, budget, payroll, accounting records, contracts, tax information, IDs, and financial details. The breach was announced on Play's dark web leak site, indicating a significant data exfiltration event.

About the Play Ransomware Group

Play ransomware, operated by Ransom House, is known for targeting Linux systems and is associated with the Babuk code. The group has evolved to deploy cryptographic lockers, focusing on ESXi lockers. Play ransomware is characterized by its unique verbose ransom notes and the use of Sosemanuk for encryption. The group has been active since 2021 and has a history of submitting binaries to VirusTotal containing various hack tools and utilities.

Potential Vulnerabilities and Penetration Methods

Brainworks Software's focus on media and publishing makes it a valuable target for ransomware groups like Play. The company's extensive client base and the sensitive nature of its data, including financial and personal information, increase its attractiveness to threat actors. Play ransomware likely penetrated Brainworks Software's systems through vulnerabilities in their network security, possibly exploiting weak points in their Linux-based infrastructure or through phishing attacks targeting employees.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.