Ransomware Attack on Sherbrooke Metals by BrainCipher Exposes 25GB of Data

Incident Date:

July 21, 2024

World map

Overview

Title

Ransomware Attack on Sherbrooke Metals by BrainCipher Exposes 25GB of Data

Victim

Sherbrooke Metals

Attacker

BrainCypher

Location

Willoughby, USA

Ohio, USA

First Reported

July 21, 2024

Ransomware Attack on Sherbrooke Metals by BrainCipher

Company Overview

Sherbrooke Metals, based in Willoughby, Ohio, is a specialized manufacturer known for its production of advanced metal products, particularly Elkonite® copper-tungsten materials. These materials are prized for their high electrical conductivity and mechanical strength, making them essential in industries requiring durability and performance under high-stress conditions. The company operates with a small team of 2-10 employees, allowing for a focused and specialized approach to their products and services.

Attack Overview

On July 22, 2024, Sherbrooke Metals fell victim to a ransomware attack orchestrated by the cybercriminal group BrainCipher. The attackers reportedly exfiltrated 25GB of confidential data from the company. To substantiate their claims, BrainCipher leaked a sample of the stolen data on their dark web leak site. This breach has put Sherbrooke Metals in a precarious position as they navigate the aftermath of this significant security incident.

Vulnerabilities and Impact

Sherbrooke Metals' small team and specialized focus may have contributed to vulnerabilities in their cybersecurity measures. The manufacturing sector, particularly companies dealing with advanced materials like Elkonite®, is often targeted by ransomware groups due to the critical nature of their operations and the high value of their intellectual property. The breach highlights the importance of robust cybersecurity measures, even for smaller enterprises.

About BrainCipher

BrainCipher is a relatively new ransomware group that emerged in June 2024. The group gained notoriety after a high-profile attack on Indonesia’s National Data Center. BrainCipher primarily uses phishing and spear phishing to deliver their ransomware payloads, which are based on LockBit. The group is known for encrypting files and appending a distinctive file extension, as well as encrypting file names. They operate a TOR-based data leak site where they publish information about companies that fail to protect personal data.

Penetration Methods

BrainCipher likely penetrated Sherbrooke Metals' systems through phishing or spear phishing attacks, possibly facilitated by initial access brokers. Once inside, they deployed their ransomware payload, encrypting files and exfiltrating data. The group's sophisticated techniques, including hiding threads from debuggers and executing in a suspended mode, make detection and mitigation challenging.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.