Ransomware Attack on Armour Coatings Highlights Cybersecurity Risks
Incident Date:
August 21, 2024
Overview
Title
Ransomware Attack on Armour Coatings Highlights Cybersecurity Risks
Victim
Armour Coatings
Attacker
Play
Location
First Reported
August 21, 2024
Ransomware Attack on Armour Coatings by Play Ransomware Group
Armour Coatings, a specialized company located in Germantown, Wisconsin, has recently fallen victim to a ransomware attack orchestrated by the Play ransomware group. The attack was identified on August 21, and the compromised data was publicly posted on the dark web on August 26, garnering significant attention.
About Armour Coatings
Armour Coatings operates a 45,000 square foot facility and focuses on custom powder coating and sandblasting services. The company employs advanced technologies to ensure high-quality finishes for various metal substrates. Their primary service, powder coating, uses electrostatic spray deposition (ESD) to apply a durable and high-density cross-linked coating. Additionally, they offer sandblasting services using Aluminum Oxide media to prepare surfaces for optimal adhesion and finish quality.
Since its establishment in 2003, Armour Coatings has built a reputation for delivering quality services across diverse industries, including architectural, automotive, industrial supply, and more. The company is known for helping clients maintain their ISO certification standards, making it a trusted partner for businesses requiring metal finishing solutions.
Attack Overview
The Play ransomware group, also known as PlayCrypt, has claimed responsibility for the attack on Armour Coatings. The group has been active since June 2022 and has targeted various industries, including IT, transportation, and critical infrastructure. The attack on Armour Coatings highlights the persistent threat of ransomware across specialized industrial sectors.
The specific details of the compromised data remain unclear, but the incident underscores the vulnerabilities that companies like Armour Coatings face. The Play ransomware group is known for exploiting RDP servers, FortiOS vulnerabilities, and Microsoft Exchange vulnerabilities to gain initial access to networks. They use tools like Mimikatz for privilege escalation and employ custom tools to enumerate users and computers on compromised networks.
About Play Ransomware Group
The Play ransomware group distinguishes itself by not including an initial ransom demand or payment instructions in its ransom notes. Instead, victims are directed to contact the threat actors via email. The group uses various methods to maintain persistence on compromised systems, including scheduled tasks and PsExec. They also employ tools to disable antimalware and monitoring solutions, making it challenging for victims to detect and mitigate the attack.
The group has impacted over 300 entities, including businesses and critical infrastructure across multiple regions. Their dark web presence includes a data leak site where they post information about their attacks and victims, further pressuring victims to comply with their demands.
Conclusion
The ransomware attack on Armour Coatings by the Play ransomware group serves as a stark reminder of the ongoing threat posed by cybercriminals. Companies in specialized industrial sectors must remain vigilant and adopt effective cybersecurity measures to protect their operations and sensitive data.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.