The Advanced Techniques of Cactus Group in the Coastal Cargo Ransomware Attack
Ransomware Attack on Coastal Cargo Company by Cactus Group
Overview of the Attack
A prominent player in the transportation and stevedoring industry, Coastal Cargo Company, LLC, has recently fallen victim to a ransomware attack. The attack was carried out by a cybercriminal group known as Cactus, which specializes in ransomware-as-a-service (RaaS). The attackers managed to exfiltrate 3 GB of data from the company's systems and have published this data on their site.
Company Profile
Coastal Cargo Company, LLC operates with a strong presence in the Gulf market, providing extensive portside services including terminal operations, stevedoring, and warehouse management. With nearly a century of experience, the company is known for its efficiency and quality of service, handling a diverse range of cargo types. This extensive operational scope and significant market presence make Coastal Cargo a notable entity in its sector, with an estimated revenue of $36.6 million.
Vulnerabilities and Targeting by Cactus
The Cactus ransomware group, known for its sophisticated attack methodologies, targets organizations with potentially high-value data and vulnerabilities in their cybersecurity defenses. Coastal Cargo's extensive digital footprint and significant data handling as part of its logistics and cargo management operations likely made it an attractive target for the Cactus group. The attack underscores the critical need for robust cybersecurity measures in the transportation and logistics industry, particularly for companies that manage substantial amounts of sensitive data.
Details of the Ransomware Technique
The Cactus group employed its characteristic encryption techniques, appending the ".cts1" file extension to encrypted files. This method involves sophisticated scripts that disable security tools, use custom batch scripts to deploy the ransomware, and subsequently remove traces of the initial files used for the attack. The group's ability to move laterally within the network and maintain persistence highlights the advanced nature of their operations.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!