Play Ransomware Strikes Hive Power Engineering Firm
Ransomware Attack on Hive Power Engineering: A Closer Look
On November 20, Hive Power Engineering LLC (HPE), a specialized engineering firm based in Allentown, Pennsylvania, became the latest victim of a ransomware attack orchestrated by the notorious Play ransomware group. HPE, known for its engineering design and consulting services in the Transmission and Distribution sector, has built a reputation for delivering high-quality, client-centric solutions. Despite its small size, with approximately 9 to 15 employees, the company has established itself as a reliable partner for utilities and developers in the energy sector.
Company Profile and Vulnerabilities
Hive Power Engineering's expertise lies in substation design, protection and control systems, and comprehensive power system studies. The firm's agility and innovative approach are enhanced by its small, collaborative team structure, which allows for rapid decision-making. However, this same agility may also present vulnerabilities, as smaller firms often lack the extensive cybersecurity infrastructure of larger organizations, making them attractive targets for sophisticated threat actors like Play.
Attack Overview
The Play ransomware group, known for its technical sophistication and targeted campaigns, claimed responsibility for the attack on HPE. The breach resulted in the leakage of sensitive data, including client documents, budget details, payroll information, and financial records. The full extent of the data leak and its impact on HPE's operations remain unclear.
About Play Ransomware Group
Emerging in June 2022, Play ransomware has distinguished itself through its closed operational structure and innovative techniques, such as intermittent encryption. This method encrypts only portions of files, reducing detection time and complicating defense efforts. Play's focus on high-value sectors and its collaboration with APT 45, a North Korean state-sponsored group, highlight its strategic approach to exploiting cybersecurity gaps. The group often leverages vulnerabilities like ProxyNotShell and authentication bypass flaws in VPNs to gain initial access to target environments.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!