Ransomware Hits Absolute Machine Tools by Play Group

Incident Date:

October 18, 2024

World map

Overview

Title

Ransomware Hits Absolute Machine Tools by Play Group

Victim

Absolute Machine Tools

Attacker

Play

Location

Lorain, USA

Ohio, USA

First Reported

October 18, 2024

Ransomware Attack on Absolute Machine Tools by Play Group

Absolute Machine Tools, a leading importer and distributor of CNC machine tools in North America, has become the latest victim of a ransomware attack by the notorious Play ransomware group. The attack, discovered on October 19, 2024, has compromised a significant amount of sensitive data, posing substantial risks to the company's operations and client confidentiality.

Company Profile and Industry Standing

Founded in 1988, Absolute Machine Tools has established itself as a key player in the manufacturing sector, specializing in advanced metalworking solutions. The company is known for its extensive inventory of CNC machines, including brands like Johnford, You Ji, Enshu, and Fanuc. With a strong emphasis on customer satisfaction, Absolute Machine Tools offers exceptional post-sale service and engineering support. The company operates with an Employee Stock Ownership Plan (ESOP), fostering a culture of ownership and accountability among its employees.

Details of the Ransomware Attack

The Play ransomware group, active since June 2022, has claimed responsibility for the attack on Absolute Machine Tools. The breach has led to the exposure of a wide array of sensitive data, including client documents, payroll records, and financial information. The full extent of the data leak remains undetermined, highlighting the severe impact on the company's operations and its clients' confidentiality.

Play Ransomware Group's Modus Operandi

The Play ransomware group, also known as PlayCrypt, has been involved in numerous high-profile attacks across various industries. The group is known for exploiting vulnerabilities in RDP servers, FortiOS, and Microsoft Exchange to gain initial access to networks. They employ tools like Mimikatz for privilege escalation and use custom tools to disable antimalware solutions. Unlike typical ransomware groups, Play does not include an initial ransom demand in their notes, directing victims to contact them via email instead.

Potential Vulnerabilities and Attack Penetration

Absolute Machine Tools' extensive digital infrastructure and reliance on sensitive data make it a prime target for ransomware attacks. The Play group likely exploited vulnerabilities in the company's network, potentially through compromised VPN accounts or unpatched software vulnerabilities. The attack underscores the critical need for enhanced cybersecurity measures in the manufacturing sector, particularly for companies handling sensitive client data.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.