BlackBasta Ransomware Strikes Driver Group Plc
BlackBasta Ransomware Attack on Driver Group Plc
Overview of Driver Group Plc
Driver Group Plc is a United Kingdom-based global consultancy firm specializing in dispute avoidance and dispute resolution within the construction, engineering, and industrial sectors. With a workforce of 277 employees and a reported revenue of £42.63 million, the company offers a range of services including strategic commercial improvement, contract management, forensic delay analysis, and training seminars. Their expertise in managing and mitigating risks, resolving disputes, and ensuring project completion on time and within budget makes them a standout in their industry.
Details of the Ransomware Attack
Recently, Driver Group Plc fell victim to a ransomware attack executed by the BlackBasta group. The attack compromised 530GB of data, including corporate accounts, HR, finance records, personal user data, and confidential project information. The attack was publicly claimed on BlackBasta's dark web leak site, highlighting the group's use of double extortion tactics to pressure victims into paying the ransom.
About BlackBasta Ransomware Group
BlackBasta is a notorious ransomware operator that emerged in early 2022. The group is known for its targeted attacks on organizations across the US, UK, Canada, and other regions. Utilizing double extortion tactics, BlackBasta encrypts critical data and threatens to publish it if the ransom is not paid. The group employs sophisticated methods for initial access, including spear-phishing and buying network access, followed by lateral movement and credential harvesting using tools like QakBot and Mimikatz.
Penetration and Impact
BlackBasta likely penetrated Driver Group Plc's systems through a combination of phishing campaigns and exploiting vulnerabilities within the network. Once inside, the group disabled security tools, deleted shadow copies, and exfiltrated sensitive data before encrypting files. The attack underscores the vulnerabilities that even well-established firms like Driver Group Plc face from sophisticated ransomware operators.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!