Rhysida Ransomware Strikes Kiemle-Hankins, Disrupting Industrial Services

Incident Date: Jun 15, 2024

Attack Overview
VICTIM
Kiemle-Hankins
INDUSTRY
Manufacturing
LOCATION
USA
ATTACKER
Rhysida
FIRST REPORTED
June 15, 2024

Rhysida Ransomware Group Targets Kiemle-Hankins in Devastating Cyber Attack

Overview of Kiemle-Hankins

Kiemle-Hankins, headquartered in Perrysburg, Ohio, is a prominent industrial service and repair provider with over 80 years of experience. The company specializes in electrical and mechanical services, offering comprehensive solutions for the maintenance, repair, and optimization of industrial equipment. With five state-of-the-art facilities across Ohio, Michigan, Kentucky, Indiana, and Illinois, Kiemle-Hankins serves a diverse range of industries, including manufacturing, utilities, and commercial sectors. The company generated $22.3 million in revenue recently and employs over 100 skilled technicians and professionals.

Details of the Ransomware Attack

On a recent date, Kiemle-Hankins fell victim to a ransomware attack orchestrated by the Rhysida Ransomware Group. The attackers have claimed responsibility for the breach and are auctioning off exclusive data stolen from the company. The data auction deadline is set for 6 days and 23 hours, with a ransom price of 5 BTC (Bitcoin). The attack has significantly impacted Kiemle-Hankins' operations, threatening the confidentiality and integrity of their critical data.

About the Rhysida Ransomware Group

The Rhysida Ransomware Group emerged in May 2023 and has since targeted various sectors, including education, healthcare, manufacturing, information technology, and government. Rhysida ransomware is written in C++ and primarily targets Windows Operating Systems. The group employs a double extortion technique, stealing data before encrypting it and threatening to publish it on the dark web unless a ransom is paid. Rhysida uses the ChaCha20 encryption algorithm and generates ransom notes as PDF documents named “CriticalBreachDetected.pdf.”

Penetration and Impact

Rhysida typically gains initial access through phishing campaigns and leveraging valid credentials. They establish network connections via VPN and use tools like Advance IP/Port Scanner and Sysinternals PsExec for lateral movement. The group's unpredictable activity pattern and sophisticated techniques make them a formidable threat. The attack on Kiemle-Hankins underscores the vulnerabilities in industrial sectors, where the disruption of critical services can have far-reaching consequences.

Sources

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.