Ransomware Attack on Kinter by Play Group Compromises Sensitive Data
Ransomware Attack on Kinter by Play Group
Overview of Kinter
Kinter, also known as K International, Inc., is a prominent distributor of retail display solutions headquartered in Waukegan, Illinois. The company operates an 84,000 square foot warehouse and employs approximately 150 people. Kinter specializes in designing, manufacturing, and distributing a variety of products aimed at enhancing the visual appeal and organizational efficiency of retail spaces. Their offerings include display hooks, sign holders, shelf management systems, and other point-of-purchase display accessories. Kinter's commitment to innovation and customer satisfaction has made them a trusted partner for top retailers in the United States.
Details of the Attack
The ransomware group Play has claimed responsibility for a cyberattack on Kinter. The attack, which was announced on Play's dark web leak site, resulted in the compromise of private and personal confidential data, including client documents, budget, payroll, accounting, contracts, taxes, IDs, and financial information. The breach has raised significant concerns about the security measures in place at Kinter and the potential impact on their operations and clients.
About the Play Ransomware Group
Play ransomware is a notable actor in the cybercrime landscape, known for targeting Linux systems. The group is associated with the Babuk code and has evolved to target ESXi lockers. Play ransomware is operated by Ransom House, which initially focused on data theft but has since adopted cryptographic lockers. The group is known for its sophisticated tactics, including the use of Sosemanuk for encryption and a unique verbose ransom note that provides explicit instructions to victims.
Penetration and Vulnerabilities
Play ransomware actors have been observed using various hack tools and utilities to gain initial access to target systems. These tools include AnyDesk, NetCat, and encoded PowerShell Empire scripts. The group's ability to exploit vulnerabilities in Linux environments and their sophisticated approach to victim communication distinguish them from other ransomware actors. Kinter's reliance on digital systems for managing their extensive product offerings and client data may have made them an attractive target for Play ransomware.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!