Berexco LLC Hit by Akira Ransomware Exposing Sensitive Data
Ransomware Attack on Berexco LLC: A Detailed Analysis
In a significant cybersecurity incident, Berexco LLC, an independent oil and gas exploration and production company based in Wichita, Kansas, has fallen victim to a ransomware attack orchestrated by the Akira group. This attack underscores the vulnerabilities faced by companies in the energy sector, particularly those with extensive operational footprints and sensitive data.
About Berexco LLC
Berexco LLC is a prominent player in the oil and gas industry, with operations spanning across eight mid-continent states, including Kansas, Nebraska, and Oklahoma. The company is known for its comprehensive approach to resource extraction, combining geological and geophysical analysis with reservoir engineering and project management. Berexco's commitment to sustainability and compliance, alongside its involvement in renewable energy solutions, distinguishes it within the industry. With approximately 400 employees and a reported revenue of $456.6 million, Berexco is a significant contributor to the local economies where it operates.
Attack Overview
The ransomware attack on Berexco has resulted in the compromise of sensitive data, including employee contact information, credit card details, and internal financial documentation. The attackers have also accessed the contacts of Berexco's service providers, heightening the potential impact of the breach. The Akira group, known for its double extortion tactics, has threatened to release this data, pressuring Berexco to respond swiftly to mitigate the damage.
About the Akira Ransomware Group
Emerging in March 2023, Akira operates as a Ransomware-as-a-Service (RaaS) entity, leveraging a double extortion model to target sectors with high-stakes data. The group is noted for its technical sophistication and potential connections to the former Conti group. Akira's use of a Rust-based Linux variant for VMware ESXi environments highlights its cross-platform targeting capabilities. The group typically demands ransoms ranging from $200,000 to $4 million, payable in Bitcoin.
Potential Vulnerabilities and Penetration Methods
Berexco's extensive digital infrastructure and reliance on sensitive data make it an attractive target for ransomware groups like Akira. The attack may have been facilitated through compromised VPN credentials, spear-phishing, or exploiting unpatched vulnerabilities in systems such as Cisco ASA and FortiClient. Akira's ability to disable security measures and maintain persistent access further complicates the defense against such attacks.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!