Play Ransomware Group Targets Brainworks Software, Compromises Sensitive Data
Ransomware Attack on Brainworks Software by Play Group
Overview of Brainworks Software
Brainworks Software, founded in 1988 and headquartered in Central Islip, New York, specializes in providing advanced software solutions for the media and publishing industries. With over 30 years of experience, the company has installed its software at over 415 companies. Brainworks Software focuses on advertising sales, circulation management, and content management, aiming to enhance operational efficiency for newspapers, magazines, and other media outlets. The company employs approximately 40 people and has an estimated revenue of $16 million.
Details of the Ransomware Attack
The ransomware group Play has claimed responsibility for a recent attack on Brainworks Software. The attack compromised private and personal confidential data, client documents, budget, payroll, accounting records, contracts, tax information, IDs, and financial details. The breach was announced on Play's dark web leak site, indicating a significant data exfiltration event.
About the Play Ransomware Group
Play ransomware, operated by Ransom House, is known for targeting Linux systems and is associated with the Babuk code. The group has evolved to deploy cryptographic lockers, focusing on ESXi lockers. Play ransomware is characterized by its unique verbose ransom notes and the use of Sosemanuk for encryption. The group has been active since 2021 and has a history of submitting binaries to VirusTotal containing various hack tools and utilities.
Potential Vulnerabilities and Penetration Methods
Brainworks Software's focus on media and publishing makes it a valuable target for ransomware groups like Play. The company's extensive client base and the sensitive nature of its data, including financial and personal information, increase its attractiveness to threat actors. Play ransomware likely penetrated Brainworks Software's systems through vulnerabilities in their network security, possibly exploiting weak points in their Linux-based infrastructure or through phishing attacks targeting employees.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!