Hayden Power Group Hit by Play Ransomware Attack, Compromises Sensitive Data
Hayden Power Group Targeted by Play Ransomware Attack
Company Overview
Hayden Power Group, a family-owned electrical contractor based in Hazleton, Pennsylvania, has been providing superior electrical services since 1975. With a workforce of around 50 employees and an estimated annual revenue of $25 million, the company serves both commercial and industrial clients across Northeast and Central Pennsylvania. Known for its commitment to safety, customer satisfaction, and community engagement, Hayden Power Group recently expanded its operations with a new state-of-the-art facility.
Attack Overview
The Play ransomware group has claimed responsibility for a recent cyberattack on Hayden Power Group. The attackers have reportedly compromised a significant amount of sensitive data, including private and personal confidential information, client documents, budget details, payroll records, accounting files, contracts, tax information, IDs, and financial data. This breach poses a serious risk to the company's reputation and its mission to provide top-tier electrical services.
Ransomware Group Profile
The Play ransomware group, also known as PlayCrypt, has been active since June 2022. Initially targeting Latin America, the group has expanded its operations to North America, South America, and Europe. Play ransomware is known for targeting a diverse range of industries, including IT, transportation, construction, materials, government entities, and critical infrastructure. The group employs various methods to gain initial access, such as exploiting RDP servers, FortiOS vulnerabilities, and Microsoft Exchange vulnerabilities.
Attack Methods
Play ransomware uses scheduled tasks, PsExec, and Group Policy Objects (GPOs) to execute its code and maintain persistence. The group also employs tools like Mimikatz for privilege escalation and uses custom tools to enumerate users and computers on compromised networks. Defense evasion techniques include disabling antimalware and monitoring solutions using tools like Process Hacker and GMER.
Penetration and Impact
The exact method of penetration in the Hayden Power Group attack remains unclear, but it is likely that the attackers exploited known vulnerabilities or used valid accounts to gain access. The breach threatens the company's integrity and could undermine the trust and satisfaction of both employees and customers. The attack highlights the vulnerabilities that even well-established companies face in the ever-evolving landscape of cyber threats.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!