Seattle-Tacoma Airport Hit by Rhysida Ransomware Attack
Incident Date:
September 18, 2024
Overview
Title
Seattle-Tacoma Airport Hit by Rhysida Ransomware Attack
Victim
Seattle-Tacoma International Airport (SEA)
Attacker
Rhysida
Location
First Reported
September 18, 2024
Ransomware Attack on Seattle-Tacoma International Airport by Rhysida Group
Seattle-Tacoma International Airport (SEA), a critical aviation hub in the Pacific Northwest, has fallen victim to a ransomware attack orchestrated by the Rhysida ransomware group. The Port of Seattle, which owns and operates SEA, has reportedly had sensitive data exfiltrated, potentially impacting various operational aspects of the airport.
About Seattle-Tacoma International Airport
SEA, located approximately 14 miles south of downtown Seattle and 18 miles north-northeast of Tacoma, is the busiest airport in the Pacific Northwest. It serves as a major hub for both Alaska Airlines and Delta Air Lines, facilitating connections to numerous domestic and international destinations. The airport supports 31 airlines and handles millions of passengers annually. SEA is recognized for its extensive amenities, including dining, shopping, and business facilities, as well as its commitment to sustainability.
Attack Overview
The Rhysida ransomware group claims to have successfully infiltrated SEA's systems, exfiltrating sensitive information. The attack has raised concerns about the potential disruption of both passenger and cargo services. The exact nature of the compromised data has not been disclosed, but it could include critical operational details and personal information of passengers and employees.
About Rhysida Ransomware Group
Rhysida is a relatively new ransomware group, first identified in May 2023. The group targets various sectors, including education, healthcare, manufacturing, IT, and government. Rhysida employs a double extortion technique, stealing data before encrypting it and threatening to publish it unless a ransom is paid. The ransomware is written in C++ and uses the ChaCha20 encryption algorithm. The group typically deploys the ransomware through phishing campaigns and leverages valid credentials to gain initial access.
Penetration and Impact
Rhysida likely penetrated SEA's systems through phishing campaigns or by exploiting valid credentials. Once inside, the group used tools like Advance IP/Port Scanner and Sysinternals PsExec to move laterally and deploy the ransomware. The attack underscores the vulnerabilities in SEA's cybersecurity infrastructure, highlighting the need for enhanced security measures to protect against sophisticated threat actors.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.