Ransomware Hits RobbJack and Crystallume in Manufacturing Sector
Incident Date:
October 10, 2024
Overview
Title
Ransomware Hits RobbJack and Crystallume in Manufacturing Sector
Victim
RobbJack & Crystallume
Attacker
Play
Location
First Reported
October 10, 2024
Ransomware Attack on RobbJack & Crystallume: A Deep Dive into the PLAY Group's Latest Target
RobbJack Corporation and its subsidiary, Crystallume, have recently fallen victim to a ransomware attack orchestrated by the notorious PLAY ransomware group. This incident highlights the vulnerabilities faced by companies in the advanced manufacturing sector, particularly those specializing in high-performance cutting tools and coatings.
Victim Profile: RobbJack & Crystallume
RobbJack Corporation, based in California, is a prominent player in the manufacturing industry, known for its solid carbide cutting tools and end mills. The company employs approximately 200 people and generates an estimated annual revenue of $20 million. Crystallume, acquired by RobbJack in 1999, specializes in Chemical Vapor Deposition (CVD) and Physical Vapor Deposition (PVD) diamond coatings. These coatings are crucial for enhancing tool performance in industries such as aerospace, automotive, and medical sectors. Crystallume's commitment to innovation and quality has made it a leader in the diamond coating market.
Attack Overview
The PLAY ransomware group claims to have infiltrated the systems of RobbJack and Crystallume, accessing sensitive data including client documents, payroll records, and financial information. The attackers have threatened to release this data on October 11, 2023, if their demands are not met. This breach underscores the significant risk posed by ransomware attacks to businesses, particularly those in the manufacturing and technology sectors.
About the PLAY Ransomware Group
Active since June 2022, the PLAY ransomware group, also known as PlayCrypt, has targeted a diverse range of industries across North America, South America, and Europe. The group is known for exploiting vulnerabilities in RDP servers, FortiOS, and Microsoft Exchange to gain initial access. Unlike typical ransomware groups, PLAY does not include an initial ransom demand in its notes, directing victims to contact them via email instead.
Potential Vulnerabilities
RobbJack and Crystallume's reliance on advanced manufacturing technologies may have made them attractive targets for the PLAY group. The use of outdated software or insufficiently secured remote access points could have provided entry points for the attackers. This incident serves as a stark reminder of the importance of effective cybersecurity measures to protect sensitive corporate and client data.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.