Thai Agri Foods Public Company Limited Targeted by LockBit 3.0 Ransomware
Incident Date:
May 9, 2024
Overview
Title
Thai Agri Foods Public Company Limited Targeted by LockBit 3.0 Ransomware
Victim
Thai Agri Foods Public Company Limited
Attacker
Lockbit3
Location
First Reported
May 9, 2024
Ransomware Attack on Thai Agri Foods Public Company Limited
Victim Profile
Thai Agri Foods Public Company Limited, also known as TAF, is a well-established company specializing in producing and exporting a variety of food products. They offer canned, frozen foods, rice, seafood, vegetables, fruit, tuna, coconut milk, fruit juices, and pet foods. TAF has a diverse product range under various brands like Aroy-D, Savoy, Foco, Panchy, Little Chef, Uni Eagle, and Fuco, catering to global customers across 70 countries on 6 continents.
Company Size and Standout
TAF has a registered and paid-up capital of Baht 424 million, showcasing its financial stability. The company's commitment to product quality and production standards sets them apart in the industry. Their mission statement emphasizes customer satisfaction through high-quality products.
Vulnerabilities and Attack Details
Thai Agri Foods became a target of a cyberattack by the LockBit 3.0 ransomware group, resulting in the exfiltration of 261 GB of sensitive data, including accounting, financial, and customer information. The attackers released a sample of the leaked data, indicating a potential data breach. The company's online presence through their website may have been exploited by threat actors to gain unauthorized access to their systems.
Ransomware Group Overview
LockBit 3.0, also known as LockBit Black, is a sophisticated ransomware group that operates under a Ransomware-as-a-Service (RaaS) model. This group has been actively recruiting affiliates and targeting businesses and critical infrastructure organizations globally. LockBit 3.0 is known for its advanced encryption capabilities, obfuscation techniques, and the ability to move laterally through networks, making it a potent threat in the cybersecurity landscape.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.