Ransomware Hits Power Torque Services by Play

Incident Date:

October 5, 2024

World map

Overview

Title

Ransomware Hits Power Torque Services by Play

Victim

Power Torque Services LLC

Attacker

Play

Location

Punxsutawney, USA

Pennsylvania, USA

First Reported

October 5, 2024

Ransomware Attack on Power Torque Services LLC: A Detailed Analysis

Power Torque Services LLC, a key player in the oil and gas industry, has recently fallen victim to a ransomware attack by the notorious Play ransomware group. This incident underscores the persistent threat that ransomware poses to critical infrastructure sectors.

About Power Torque Services LLC

Headquartered in Gray, Louisiana, Power Torque Services LLC specializes in providing drilling, production, and completion services to the oil and gas industry. The company operates multiple locations across the United States, including Bossier City, Louisiana; Brookhaven, Mississippi; El Campo, Texas; and Punxsutawney, Pennsylvania. With a workforce of approximately 57 employees, Power Torque is known for its advanced equipment and comprehensive suite of services, including tubing and casing services, testing, and torque turn services. Their strategic positioning and commitment to quality make them a distinguished service provider in the energy sector.

Attack Overview

The Play ransomware group has claimed responsibility for the attack on Power Torque Services, asserting that they have accessed sensitive data. While specific details about the compromised data remain undisclosed, the breach highlights vulnerabilities within the company's cybersecurity framework. The attack could potentially disrupt Power Torque's operations, given their critical role in the energy extraction and management industry.

About the Play Ransomware Group

Active since June 2022, the Play ransomware group, also known as PlayCrypt, has targeted various industries, including IT, transportation, and critical infrastructure. The group is known for exploiting vulnerabilities in RDP servers, FortiOS, and Microsoft Exchange to gain initial access. They employ sophisticated techniques such as using scheduled tasks and PsExec for execution and persistence, and tools like Mimikatz for privilege escalation. Play ransomware distinguishes itself by not including an initial ransom demand in its notes, directing victims to contact them via email instead.

Potential Vulnerabilities

Power Torque Services' reliance on advanced technologies and equipment could have been a double-edged sword, providing potential entry points for cyber attackers. The company's operations across multiple locations may also present challenges in maintaining a unified cybersecurity posture, making them susceptible to sophisticated ransomware attacks like those executed by the Play group.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.