Ransomware Attack on EMA Design Automation by LockBit 3.0
Ransomware Attack on EMA Design Automation by LockBit 3.0
Victim Overview
EMA Design Automation, a company specializing in electronic design automation (EDA) software solutions for the semiconductor industry, headquartered in Rochester, New York, became a target of the LockBit 3.0 ransomware group. The attack compromised their website, resulting in the exfiltration of 445 GB of sensitive data, including personally identifiable information (PII), financial data, and employees' data.
Standout Features
The company specializes in providing product development solutions, including EDA tools, PLM integrations, services, training, and technical support. As a Cadence Channel Partner for North America, their focus is on serving the manufacturing industry. Additionally, they offer custom solutions such as Ultra Librarian, TimingDesigner, CircuitSpace, CIP, and EDABuilder, distributed globally through a network of value-added resellers. With 110 employees, the company operates with a significant workforce to support its range of services and solutions.
Attack Details
The LockBit 3.0 ransomware attack on EMA Design Automation involved the encryption of files, modification of filenames, changes to the desktop wallpaper, and the dropping of a ransom note on the victim's desktop. The ransomware is heavily obfuscated and protected against analysis, making it challenging for security researchers to study. LockBit 3.0 has features that allow lateral movement through a network via group policy updates and the deletion of traces to cover its tracks.
Ransomware Group Overview
LockBit 3.0, also known as LockBit Black, is a Ransomware-as-a-Service (RaaS) group that has evolved from previous versions of LockBit. It is considered one of the most dangerous and disruptive ransomware threats currently active, targeting a wide range of businesses and critical infrastructure organizations globally. The group operates under a RaaS model, allowing other cybercriminals to use their malware for attacks.
Vulnerabilities
EMA Design Automation's vulnerabilities in being targeted by threat actors like LockBit 3.0 may stem from the nature of their business, dealing with sensitive electronic design data for the semiconductor industry. The company's strong presence in North America and extensive network of value-added resellers could make it an attractive target for ransomware groups seeking to exploit valuable intellectual property and customer information.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!