IB Spieth Recovers from SafePay Ransomware Attack
Ransomware Attack on IB Spieth: A Detailed Analysis
Ingenieurbüro Fritz Spieth Beratende Ingenieure GmbH, commonly known as IB Spieth, recently became the target of a ransomware attack by the SafePay group. This German engineering consultancy, established in 1955, is renowned for its comprehensive engineering solutions across sectors such as traffic infrastructure, utilities, drainage, hydraulic engineering, and landscape planning. With a workforce of over 80 engineers, IB Spieth is a significant player in the engineering sector, known for its commitment to quality and sustainability.
Company Profile and Vulnerabilities
IB Spieth operates with a focus on sustainable infrastructure development and environmental stewardship, adhering to DIN EN ISO 9001 standards. The firm’s dedication to quality and transparency in project management has positioned it as a reliable partner in the engineering industry. However, like many organizations, IB Spieth's reliance on digital infrastructure makes it vulnerable to cyber threats. The company's moderate size, with 50 to 99 employees, and its extensive use of IT systems for project management and communication, may have made it an attractive target for ransomware groups like SafePay.
Attack Overview
The attack on IB Spieth was executed by SafePay, a ransomware group known for its double-extortion tactics. Upon discovering the breach, IB Spieth's management swiftly notified authorities and shut down all IT systems to protect stakeholders. The company followed an emergency protocol and IT contingency plan, allowing it to resume normal operations. Moving forward, IB Spieth plans to conduct a compromise assessment with independent experts to bolster its IT security measures.
SafePay Ransomware Group
SafePay distinguishes itself in the cybercrime landscape by employing ransomware-as-a-service tactics and utilizing LockBit source code. The group is known for its stealthy infiltration methods, often gaining access through valid credentials acquired via VPN gateways. SafePay's double-extortion strategy involves encrypting files and threatening to release stolen data if ransom demands are not met. This approach has been effective in pressuring victims to comply with their demands.
Potential Penetration Methods
SafePay likely penetrated IB Spieth's systems through compromised credentials, a common tactic for the group. By avoiding the creation of new user accounts and not relying on Remote Desktop Protocol, SafePay maintains a low profile during infiltration. This stealthy approach, combined with the group's operational security, makes it challenging for victims to detect and mitigate attacks in their early stages.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!