Ransomware Attack Disrupts Federated Co-operatives Limited by Akira Group
Ransomware Attack on Federated Co-operatives Limited by Akira Group
Overview of Federated Co-operatives Limited (FCL)
Federated Co-operatives Limited (FCL) is a significant co-operative federation based in Western Canada, established in 1944. It serves as a wholesaler and distributor to approximately 160 independent local co-operatives, including grocery stores, gas stations, and agricultural supply centers. FCL's unique model emphasizes collaboration, leveraging collective purchasing power to streamline operations and enhance sustainability across British Columbia, Manitoba, and the Arctic. The company operates in various sectors, including procurement and distribution, manufacturing, and marketing and administrative support.
Details of the Ransomware Attack
In late June, FCL experienced a ransomware attack that severely disrupted its internal and customer-facing systems. The attack led to significant operational disruptions, including the unavailability of online shopping and inconsistent grocery supplies in Saskatoon. FCL has since restored its corporate and local websites, although online shopping services remain down. The company is actively investigating the incident with third-party cybersecurity experts and addressing claims of potential data theft. Measures are being taken to secure systems and data and to fully restore all operations.
About the Akira Ransomware Group
The Akira ransomware group emerged in March 2023 and has rapidly grown, targeting small to medium-sized businesses across Europe, North America, and Australia. The group employs double extortion tactics, stealing data before encrypting systems and demanding ransoms ranging from $200,000 to over $4 million. Akira's dark web leak site features a retro 1980s-style interface. The group uses unauthorized access to VPNs, credential theft, and lateral movement to deploy ransomware, often utilizing tools like RClone, FileZilla, and WinSCP for data exfiltration. Akira has also expanded its operations to target Linux-based VMware ESXi virtual machines.
Potential Vulnerabilities and Penetration Methods
FCL's extensive network of independent co-operatives and its reliance on interconnected systems for procurement, distribution, and administrative support may have presented vulnerabilities. The Akira group likely exploited these vulnerabilities through unauthorized access to VPNs and credential theft. The use of tools for data exfiltration and the deployment of ransomware across both Windows and Linux systems indicate a sophisticated and well-coordinated attack strategy.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!