Ransomware Hits RobbJack and Crystallume in Manufacturing Sector
Ransomware Attack on RobbJack & Crystallume: A Deep Dive into the PLAY Group's Latest Target
RobbJack Corporation and its subsidiary, Crystallume, have recently fallen victim to a ransomware attack orchestrated by the notorious PLAY ransomware group. This incident highlights the vulnerabilities faced by companies in the advanced manufacturing sector, particularly those specializing in high-performance cutting tools and coatings.
Victim Profile: RobbJack & Crystallume
RobbJack Corporation, based in California, is a prominent player in the manufacturing industry, known for its solid carbide cutting tools and end mills. The company employs approximately 200 people and generates an estimated annual revenue of $20 million. Crystallume, acquired by RobbJack in 1999, specializes in Chemical Vapor Deposition (CVD) and Physical Vapor Deposition (PVD) diamond coatings. These coatings are crucial for enhancing tool performance in industries such as aerospace, automotive, and medical sectors. Crystallume's commitment to innovation and quality has made it a leader in the diamond coating market.
Attack Overview
The PLAY ransomware group claims to have infiltrated the systems of RobbJack and Crystallume, accessing sensitive data including client documents, payroll records, and financial information. The attackers have threatened to release this data on October 11, 2023, if their demands are not met. This breach underscores the significant risk posed by ransomware attacks to businesses, particularly those in the manufacturing and technology sectors.
About the PLAY Ransomware Group
Active since June 2022, the PLAY ransomware group, also known as PlayCrypt, has targeted a diverse range of industries across North America, South America, and Europe. The group is known for exploiting vulnerabilities in RDP servers, FortiOS, and Microsoft Exchange to gain initial access. Unlike typical ransomware groups, PLAY does not include an initial ransom demand in its notes, directing victims to contact them via email instead.
Potential Vulnerabilities
RobbJack and Crystallume's reliance on advanced manufacturing technologies may have made them attractive targets for the PLAY group. The use of outdated software or insufficiently secured remote access points could have provided entry points for the attackers. This incident serves as a stark reminder of the importance of effective cybersecurity measures to protect sensitive corporate and client data.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!