Elutia Targeted: BlackBasta Ransomware Breach
BlackBasta Ransomware Attack on Elutia
Overview of Elutia
Elutia, formerly known as Aziyo Biologics, is a commercial-stage biotechnology company specializing in regenerative medicine and advanced biomaterials. The company focuses on developing innovative products designed to improve patient outcomes in cardiology, orthopedics, and soft tissue repair. Elutia's core expertise lies in creating biologic solutions that integrate seamlessly with the human body to promote healing and tissue regeneration. The company is headquartered in Silver Spring, Maryland, and trades on the Nasdaq exchange under the ticker symbol ELUT.
Details of the Attack
The ransomware group BlackBasta executed a ransomware attack on Elutia, claiming responsibility for the breach. The attackers reported exfiltrating over 550GB of data, including employee personnel files, corporate data related to finance, payroll, and human resources, as well as tax forms, passports, and other personal and confidential documents. Additionally, research and development documents were stolen, with some folders labeled "Aziyo", "Development", "Clinical Research", "Customer Service", "FDA", "Finance", and "InstronData."
About BlackBasta
BlackBasta is a ransomware operator and Ransomware-as-a-Service (RaaS) criminal enterprise that emerged in early 2022. The group is believed to have connections to the defunct Conti threat actor group. BlackBasta targets organizations in highly targeted attacks, employing a double extortion tactic by encrypting critical data and threatening to publish sensitive data on their public leak site if the ransom is not paid. The group uses sophisticated methods for initial access, lateral movement, and data exfiltration, including spear-phishing campaigns, insider information, and exploiting vulnerabilities.
Penetration and Vulnerabilities
BlackBasta likely penetrated Elutia's systems through a combination of spear-phishing campaigns and exploiting vulnerabilities within the company's network. The group's use of tools like QakBot, Mimikatz, and Cobalt Strike Beacons for lateral movement and credential harvesting suggests a highly sophisticated attack. Elutia's focus on advanced biomaterials and regenerative medicine, coupled with the sensitive nature of their research and development data, made them an attractive target for the ransomware group.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!