Ransomware Hits Italian Dairy Cooperative: Meow Group Strikes
Ransomware Attack on Caseificio Alta Valsesia by Meow Group
Caseificio Alta Valsesia, a distinguished dairy cooperative based in Piode, Italy, has recently fallen victim to a ransomware attack orchestrated by the notorious Meow ransomware group. The attack, discovered on September 2, 2024, has raised significant concerns about the security of small to medium-sized enterprises in the agriculture sector.
About Caseificio Alta Valsesia
Founded in 1956, Caseificio Alta Valsesia is a cooperative that specializes in producing high-quality artisanal cheeses. The cooperative sources milk from approximately 35 local farms in the Alta Valsesia region, maintaining traditional cheesemaking methods while incorporating modern hygiene and production standards. Their flagship product, "Toma Valsesiana," is renowned for its quality and authenticity.
The cooperative operates a modern production facility and employs between 20 to 49 people. Their product range includes various types of fresh and aged cheeses, butter, and ricotta. The cooperative also plays a crucial role in the local economy, providing employment and supporting the livelihoods of local dairy farmers.
Attack Overview
The ransomware attack targeted the company's website, caseificioaltavalsesia.it. While the exact size of the data leak remains unknown, the incident has disrupted the cooperative's operations and raised concerns about the security of their digital infrastructure. The attack underscores the growing threat of ransomware attacks on businesses of all sizes and sectors.
About Meow Ransomware Group
Meow Ransomware is a threat actor group that emerged in late 2022 and has been associated with the Conti v2 ransomware variant. The group employs various infection methods, including phishing emails, exploit kits, Remote Desktop Protocol (RDP) vulnerabilities, and malvertising. Once a system is compromised, the ransomware encrypts files using a combination of the ChaCha20 and RSA-4096 algorithms.
Meow Ransomware is known for targeting industries with sensitive data, such as healthcare and medical research. They maintain a data leak site where they list victims who have not paid the ransom. The group leaves behind a ransom note named "readme.txt" that instructs victims to contact them via email or Telegram to negotiate the ransom payment.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!