Ransomware Attack on Vision Mechanical Services, Inc. by BlackSuit
Ransomware Attack on Vision Mechanical Services, Inc. by BlackSuit
Victim Overview
Vision Mechanical Services, Inc. is a leading HVAC contractor based in Agoura Hills, California. The company specializes in Heating Ventilating and Air Conditioning (HVAC) services for commercial and industrial clients in the Greater Vancouver area. They offer installation, maintenance, and repair services for a wide range of mechanical systems. They stand out in the industry for its expertise in HVAC solutions. Providing services including design, installation, maintenance, and repair, focusing on efficiency, reliability, and customer satisfaction.
Company Vulnerabilities
As a reputable HVAC contractor, the company may have been targeted by threat actors due to the sensitive nature of the data they handle, including employee data, financial data, and business data. Their reliance on digital systems for operations could have made them susceptible to cyber attacks.
Attack Details
Vision Mechanical Services, Inc. fell victim to a ransomware attack by the cybercriminal group BlackSuit. The attackers managed to exfiltrate 335 GB of data, which included employee data, financial data, and business data. Some of the exfiltrated data was fully published, indicating the severity of the attack.
Ransomware Group - BlackSuit
BlackSuit is a new ransomware family closely related to the notorious Royal ransomware group. The group targets both Windows and Linux systems, including critical VMware ESXi infrastructure. BlackSuit distinguishes itself by appending the .blacksuit extension to encrypted files and dropping a ransom note named README.BlackSuit.txt in affected directories.
Attack Penetration
The ransomware group could have penetrated Vision Mechanical Services, Inc.'s systems through various means, including phishing emails, unpatched software vulnerabilities, or weak remote desktop protocol (RDP) configurations. The high degree of similarity between BlackSuit and Royal ransomware suggests a connection between the two groups, indicating a sophisticated and organized cybercriminal operation.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!