LockBit 3.0 Ransomware Attack on Kioti Tractor
Ransomware Attack on Kioti Tractor by LockBit 3.0
Overview
The cyberattack on KIOTI by the LockBit 3.0 ransomware group in May 2024 targeted the company's website and originated from the USA. The attackers were able to exfiltrate 382 GB of sensitive data, including accounting records, business operations data, financial records, HR information, and personally identifiable information (PII). A sample of this leaked data was made available, increasing the potential damage to Kioti's reputation and security.
Company Profile
Kioti Tractor, also known as Daedong in North America and Europe, is a leading company specializing in high-quality tractors, UTVs, zero-turn mowers, attachments, and implements. The company was established in 1993 and is headquartered in Wendell, North Carolina. Kioti is committed to providing top-notch products and services, with a focus on customer satisfaction and teamwork.
The company offers a wide range of tractor models, utility vehicles, and attachments, catering to various needs from commercial farming to hobby farming and garden maintenance. Kioti has a strong dealer network of over 450 dealers in the U.S., ensuring efficient distribution and service. The company has a rich history of innovation and growth, continuously expanding its product lines and implementing advanced technologies in its machinery.
LockBit 3.0 Ransomware Group
LockBit 3.0, also known as LockBit Black, is a new variant of the LockBit ransomware that emerged in 2022. It is considered one of the most dangerous and disruptive ransomware threats currently active. The ransomware encrypts files, modifies their filenames, changes the desktop wallpaper, and drops a ransom note on the victim's desktop. LockBit 3.0 is heavily obfuscated and protected against analysis, making it challenging for security researchers to study. The ransomware has features like lateral movement through a network via group policy updates and the ability to delete traces of itself to cover its tracks.
LockBit May Attacks
This is part of the May 2024 attacks by LockBit 3.0, a cybercriminal group that resurfaced following the disruption of its infrastructure in February during "Operation Cronos." Despite law enforcement efforts, LockBit swiftly returned, targeting over 50 victims within hours of reactivating its platform. The group's recent activities targeted diverse industries globally, with manufacturing companies, professional services, and the ICT sector being the most affected. LockBit's resurgence highlights the need for enhanced international cooperation and proactive measures to combat cybercrime effectively.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!