Cactus Ransomware Group Targets Sofidel UK, Compromises 74GB Data
Ransomware Attack on Sofidel UK by Cactus Group
Company Profile: Sofidel UK Limited
Sofidel UK Limited, a subsidiary of the Italian-based Sofidel Group, is a prominent player in the global tissue paper market. Known for its commitment to sustainability and innovation, the company manufactures a variety of tissue products including toilet paper and kitchen towels. With a focus on environmental responsibility, Sofidel UK employs advanced manufacturing technologies to ensure both efficiency and quality in its production processes. The company's dedication to sustainable practices and high-quality products distinguishes it in the tissue paper industry.
Details of the Ransomware Attack
The Cactus ransomware group recently targeted Sofidel UK Limited, resulting in the exfiltration of 74GB of sensitive data. This breach compromised personal identifiable information, financial documents, and corporate correspondence. The attack not only threatens the privacy of employees and customers but also poses significant operational and reputational risks for Sofidel UK, which boasts an estimated revenue of $3 billion.
Profile of the Cactus Ransomware Group
The Cactus ransomware group, known for its sophisticated cyber-attacks, operates as a ransomware-as-a-service (RaaS). This group has been active since March 2023, exploiting vulnerabilities such as the ZeroLogon to infiltrate organizations globally. Cactus distinguishes itself through unique encryption techniques and the use of malvertising lures to deploy their ransomware, making them a formidable threat in the cybersecurity landscape.
Potential Vulnerabilities and Attack Vectors
Sofidel UK's significant digital footprint and extensive data repositories may have made it an attractive target for the Cactus group. The ransomware could have penetrated the company’s systems through exploited vulnerabilities in network security, possibly compounded by inadequate endpoint defenses or phishing attacks. The group’s method of using custom scripts to disable security tools before deploying the ransomware suggests a highly sophisticated attack strategy, tailored to bypass conventional security measures.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!