Ransomware Attack on EMA Design Automation by LockBit 3.0
Incident Date:
May 16, 2024
Overview
Title
Ransomware Attack on EMA Design Automation by LockBit 3.0
Victim
EMA Design Automation
Attacker
Lockbit3
Location
First Reported
May 16, 2024
Ransomware Attack on EMA Design Automation by LockBit 3.0
Victim Overview
EMA Design Automation, a company specializing in electronic design automation (EDA) software solutions for the semiconductor industry, headquartered in Rochester, New York, became a target of the LockBit 3.0 ransomware group. The attack compromised their website, resulting in the exfiltration of 445 GB of sensitive data, including personally identifiable information (PII), financial data, and employees' data.
Standout Features
The company specializes in providing product development solutions, including EDA tools, PLM integrations, services, training, and technical support. As a Cadence Channel Partner for North America, their focus is on serving the manufacturing industry. Additionally, they offer custom solutions such as Ultra Librarian, TimingDesigner, CircuitSpace, CIP, and EDABuilder, distributed globally through a network of value-added resellers. With 110 employees, the company operates with a significant workforce to support its range of services and solutions.
Attack Details
The LockBit 3.0 ransomware attack on EMA Design Automation involved the encryption of files, modification of filenames, changes to the desktop wallpaper, and the dropping of a ransom note on the victim's desktop. The ransomware is heavily obfuscated and protected against analysis, making it challenging for security researchers to study. LockBit 3.0 has features that allow lateral movement through a network via group policy updates and the deletion of traces to cover its tracks.
Ransomware Group Overview
LockBit 3.0, also known as LockBit Black, is a Ransomware-as-a-Service (RaaS) group that has evolved from previous versions of LockBit. It is considered one of the most dangerous and disruptive ransomware threats currently active, targeting a wide range of businesses and critical infrastructure organizations globally. The group operates under a RaaS model, allowing other cybercriminals to use their malware for attacks.
Vulnerabilities
EMA Design Automation's vulnerabilities in being targeted by threat actors like LockBit 3.0 may stem from the nature of their business, dealing with sensitive electronic design data for the semiconductor industry. The company's strong presence in North America and extensive network of value-added resellers could make it an attractive target for ransomware groups seeking to exploit valuable intellectual property and customer information.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.