Locke Solutions Targeted by Nitrogen Ransomware Group
Ransomware Attack on Locke Solutions by Nitrogen Group
Locke Solutions, LLC, a prominent construction service provider based in Houston, Texas, has recently fallen victim to a ransomware attack orchestrated by the notorious Nitrogen ransomware group. This incident highlights the growing threat of cyberattacks targeting the construction sector, which is increasingly reliant on digital infrastructure for its operations.
Company Profile and Industry Standing
Locke Solutions specializes in precast concrete manufacturing and offers a range of construction-related services. The company is known for its innovative Custom Plants™ service, which allows for efficient on-site production tailored to specific project needs. With a workforce of approximately 64 employees and an annual revenue of around $18.5 million, Locke Solutions has established itself as a key player in the Texas and Louisiana markets, particularly within the commercial, industrial, and energy sectors.
The company's commitment to quality and innovation, coupled with its comprehensive project management capabilities, makes it a reliable partner for various construction projects. However, its reliance on digital platforms for project management and coordination may have exposed vulnerabilities that threat actors like the Nitrogen group could exploit.
Details of the Attack
The Nitrogen ransomware group has claimed responsibility for the attack on Locke Solutions, making sample screenshots of exfiltrated data available on their dark web portal. This breach underscores the persistent threat posed by ransomware groups to businesses across various sectors. The attack likely involved sophisticated social engineering tactics and malvertising, which are hallmarks of the Nitrogen group's methodology.
Nitrogen Ransomware Group's Modus Operandi
The Nitrogen group is known for its innovative use of search engine advertisements to distribute malware. By promoting fake software sites through Google and Bing ads, they lure victims into downloading trojanized installers. These installers often employ DLL side-loading techniques to execute malicious payloads, allowing the group to gain initial access to targeted systems. Once inside, they deploy tools like Cobalt Strike and Sliver for further exploitation, leading to data exfiltration and ransomware deployment.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!