Ransomware Attack on Armour Coatings Highlights Cybersecurity Risks
Ransomware Attack on Armour Coatings by Play Ransomware Group
Armour Coatings, a specialized company located in Germantown, Wisconsin, has recently fallen victim to a ransomware attack orchestrated by the Play ransomware group. The attack was identified on August 21, and the compromised data was publicly posted on the dark web on August 26, garnering significant attention.
About Armour Coatings
Armour Coatings operates a 45,000 square foot facility and focuses on custom powder coating and sandblasting services. The company employs advanced technologies to ensure high-quality finishes for various metal substrates. Their primary service, powder coating, uses electrostatic spray deposition (ESD) to apply a durable and high-density cross-linked coating. Additionally, they offer sandblasting services using Aluminum Oxide media to prepare surfaces for optimal adhesion and finish quality.
Since its establishment in 2003, Armour Coatings has built a reputation for delivering quality services across diverse industries, including architectural, automotive, industrial supply, and more. The company is known for helping clients maintain their ISO certification standards, making it a trusted partner for businesses requiring metal finishing solutions.
Attack Overview
The Play ransomware group, also known as PlayCrypt, has claimed responsibility for the attack on Armour Coatings. The group has been active since June 2022 and has targeted various industries, including IT, transportation, and critical infrastructure. The attack on Armour Coatings highlights the persistent threat of ransomware across specialized industrial sectors.
The specific details of the compromised data remain unclear, but the incident underscores the vulnerabilities that companies like Armour Coatings face. The Play ransomware group is known for exploiting RDP servers, FortiOS vulnerabilities, and Microsoft Exchange vulnerabilities to gain initial access to networks. They use tools like Mimikatz for privilege escalation and employ custom tools to enumerate users and computers on compromised networks.
About Play Ransomware Group
The Play ransomware group distinguishes itself by not including an initial ransom demand or payment instructions in its ransom notes. Instead, victims are directed to contact the threat actors via email. The group uses various methods to maintain persistence on compromised systems, including scheduled tasks and PsExec. They also employ tools to disable antimalware and monitoring solutions, making it challenging for victims to detect and mitigate the attack.
The group has impacted over 300 entities, including businesses and critical infrastructure across multiple regions. Their dark web presence includes a data leak site where they post information about their attacks and victims, further pressuring victims to comply with their demands.
Conclusion
The ransomware attack on Armour Coatings by the Play ransomware group serves as a stark reminder of the ongoing threat posed by cybercriminals. Companies in specialized industrial sectors must remain vigilant and adopt effective cybersecurity measures to protect their operations and sensitive data.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!