Quality Plumbing Associates Inc. Ransomware Attack by LockBit 3.0
Incident Date:
May 23, 2024
Overview
Title
Quality Plumbing Associates Inc. Ransomware Attack by LockBit 3.0
Victim
Quality Plumbing Associates
Attacker
Lockbit3
Location
First Reported
May 23, 2024
Ransomware Attack on Quality Plumbing Associates by LockBit 3.0
Overview of the Attack
Quality Plumbing Associates Inc., a prominent plumbing contractor in Northern California, recently fell victim to a ransomware attack by the LockBit 3.0 group. LockBit 3.0, also known as LockBit Black, is the latest iteration of the LockBit ransomware family, recognized for its advanced encryption and evasion techniques. The attack has resulted in the exfiltration and partial publication of sensitive company data on LockBit's dark web leak site.
Company Profile
Quality Plumbing Associates Inc. is one of Northern California's largest plumbing contractors, specializing in residential and commercial services. Their offerings include plumbing repairs, installations, maintenance, drain cleaning, water heater installation, and emergency plumbing services. The company is also involved in HVAC contracting, providing electrical, heating, and air conditioning services. They are known for their commitment to customer satisfaction, safety, and community involvement.
Details of the Attack
LockBit 3.0 employs a Ransomware-as-a-Service (RaaS) model, allowing affiliates to use their ransomware to carry out attacks. The ransomware is known for its ability to evade detection and hinder analysis through various advanced techniques. It encrypts files, modifies filenames, and leaves a ransom note demanding payment for decryption keys. LockBit 3.0 can spread laterally within networks, disable security features, and delete system logs to cover its tracks.
Penetration and Impact
The initial compromise likely occurred through common vectors such as phishing, Remote Desktop Protocol (RDP) exploitation, or the exploitation of vulnerabilities in public-facing applications. Once inside the network, LockBit 3.0 escalates privileges, performs reconnaissance, and uses tools like PsExec for lateral movement. The ransomware encrypts all accessible files on both local and remote devices, significantly disrupting operations.
Characteristics of LockBit 3.0
LockBit 3.0 distinguishes itself through its modular architecture, enabling it to adapt its behavior based on specific parameters. It utilizes encrypted installers that require a password for execution, making it challenging for security researchers to analyze. Additionally, it employs techniques to avoid detection by checking for debugger presence and modifying memory protections. These features make LockBit 3.0 one of the most sophisticated and resilient ransomware variants in operation today.
Sources
- CISA - StopRansomware: LockBit 3.0
- SecurityWeek - US Government Warns Organizations of LockBit 3.0 Ransomware Attacks
- SentinelOne - LockBit 3.0 Update
- Marco Ramilli - Detected: Quality Plumbing Associates Inc falls victim to LockBit Ransomware
- Cybersecurity News - Hackers Customize LockBit 3.0 Ransomware To Attack Orgs Worldwide
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.