Bulldog Bag Ltd. Targeted in Ransomware Attack by Underground Team
Ransomware Attack on Bulldog Bag Ltd by Underground Team
Company Profile
Bulldog Bag Ltd., based in Langley, British Columbia, Canada, is a prominent player in the flexible packaging industry with over 50 years of experience. Specializing in custom printed flexible packaging products, the company employs 143 individuals and reports an annual revenue of $20.6 million. Bulldog Bag Ltd. is recognized for its high-quality customer service and product offerings, which include biodegradable materials and water-based inks, underscoring their commitment to environmental sustainability.
Details of the Ransomware Attack
The cybercrime group known as Underground Team targeted Bulldog Bag Ltd., compromising their operational integrity by deploying ransomware. The attack resulted in the exfiltration of 91.7 GB of sensitive data, including employee details, contracts, and financial records. This data was subsequently published on the dark web, posing significant privacy and security risks to the company and its stakeholders.
Attack Vector and Ransomware Characteristics
Underground Team ransomware is known for its sophisticated attack methodologies, which include the use of a 64-bit GUI application capable of executing several malicious commands. These include deleting backups, modifying registry settings, and halting critical services like MSSQLSERVER. The ransomware typically identifies system volumes using API functions and disseminates a ransom note across multiple system folders, selectively encrypting files while excluding certain filenames, extensions, and directories.
The primary infection vector for this ransomware is believed to involve advanced social engineering tactics. Phishing emails with malicious attachments or links to compromised websites are commonly used to deceive victims into initiating the ransomware. These emails are crafted to appear legitimate, often mimicking familiar entities to lure users into downloading malicious payloads disguised as software updates or legitimate applications.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!