Seattle-Tacoma Airport Hit by Rhysida Ransomware Attack
Ransomware Attack on Seattle-Tacoma International Airport by Rhysida Group
Seattle-Tacoma International Airport (SEA), a critical aviation hub in the Pacific Northwest, has fallen victim to a ransomware attack orchestrated by the Rhysida ransomware group. The Port of Seattle, which owns and operates SEA, has reportedly had sensitive data exfiltrated, potentially impacting various operational aspects of the airport.
About Seattle-Tacoma International Airport
SEA, located approximately 14 miles south of downtown Seattle and 18 miles north-northeast of Tacoma, is the busiest airport in the Pacific Northwest. It serves as a major hub for both Alaska Airlines and Delta Air Lines, facilitating connections to numerous domestic and international destinations. The airport supports 31 airlines and handles millions of passengers annually. SEA is recognized for its extensive amenities, including dining, shopping, and business facilities, as well as its commitment to sustainability.
Attack Overview
The Rhysida ransomware group claims to have successfully infiltrated SEA's systems, exfiltrating sensitive information. The attack has raised concerns about the potential disruption of both passenger and cargo services. The exact nature of the compromised data has not been disclosed, but it could include critical operational details and personal information of passengers and employees.
About Rhysida Ransomware Group
Rhysida is a relatively new ransomware group, first identified in May 2023. The group targets various sectors, including education, healthcare, manufacturing, IT, and government. Rhysida employs a double extortion technique, stealing data before encrypting it and threatening to publish it unless a ransom is paid. The ransomware is written in C++ and uses the ChaCha20 encryption algorithm. The group typically deploys the ransomware through phishing campaigns and leverages valid credentials to gain initial access.
Penetration and Impact
Rhysida likely penetrated SEA's systems through phishing campaigns or by exploiting valid credentials. Once inside, the group used tools like Advance IP/Port Scanner and Sysinternals PsExec to move laterally and deploy the ransomware. The attack underscores the vulnerabilities in SEA's cybersecurity infrastructure, highlighting the need for enhanced security measures to protect against sophisticated threat actors.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!