Ransomware Attack on Sherbrooke Metals by BrainCipher Exposes 25GB of Data
Incident Date:
July 21, 2024
Overview
Title
Ransomware Attack on Sherbrooke Metals by BrainCipher Exposes 25GB of Data
Victim
Sherbrooke Metals
Attacker
BrainCypher
Location
First Reported
July 21, 2024
Ransomware Attack on Sherbrooke Metals by BrainCipher
Company Overview
Sherbrooke Metals, based in Willoughby, Ohio, is a specialized manufacturer known for its production of advanced metal products, particularly Elkonite® copper-tungsten materials. These materials are prized for their high electrical conductivity and mechanical strength, making them essential in industries requiring durability and performance under high-stress conditions. The company operates with a small team of 2-10 employees, allowing for a focused and specialized approach to their products and services.
Attack Overview
On July 22, 2024, Sherbrooke Metals fell victim to a ransomware attack orchestrated by the cybercriminal group BrainCipher. The attackers reportedly exfiltrated 25GB of confidential data from the company. To substantiate their claims, BrainCipher leaked a sample of the stolen data on their dark web leak site. This breach has put Sherbrooke Metals in a precarious position as they navigate the aftermath of this significant security incident.
Vulnerabilities and Impact
Sherbrooke Metals' small team and specialized focus may have contributed to vulnerabilities in their cybersecurity measures. The manufacturing sector, particularly companies dealing with advanced materials like Elkonite®, is often targeted by ransomware groups due to the critical nature of their operations and the high value of their intellectual property. The breach highlights the importance of robust cybersecurity measures, even for smaller enterprises.
About BrainCipher
BrainCipher is a relatively new ransomware group that emerged in June 2024. The group gained notoriety after a high-profile attack on Indonesia’s National Data Center. BrainCipher primarily uses phishing and spear phishing to deliver their ransomware payloads, which are based on LockBit. The group is known for encrypting files and appending a distinctive file extension, as well as encrypting file names. They operate a TOR-based data leak site where they publish information about companies that fail to protect personal data.
Penetration Methods
BrainCipher likely penetrated Sherbrooke Metals' systems through phishing or spear phishing attacks, possibly facilitated by initial access brokers. Once inside, they deployed their ransomware payload, encrypting files and exfiltrating data. The group's sophisticated techniques, including hiding threads from debuggers and executing in a suspended mode, make detection and mitigation challenging.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.