Williams Construction Faces Major Play Ransomware Data Breach
Williams Construction Hit by Play Ransomware Attack
Company Overview
Williams Construction Company, based in Springfield, Missouri, is a family-owned design-build construction firm that has been operational since 1980. The company has built a strong reputation over its four-decade history for delivering high-quality construction services, emphasizing customer satisfaction and reliability. Williams Construction specializes in design-build contracting, construction management, and general contracting, with a commitment to keeping projects on time and within budget.
Attack Overview
Williams Construction has recently fallen victim to a ransomware attack orchestrated by the Play ransomware group. The attackers have compromised a wide array of sensitive data, including private and personal confidential information, client documents, budget details, payroll records, accounting files, contracts, tax information, and IDs. This breach poses significant risks to the company's operations and its clients' privacy, highlighting the critical need for robust cybersecurity measures.
About the Play Ransomware Group
The Play ransomware group, also known as PlayCrypt, has been active since June 2022 and has been responsible for numerous high-profile attacks. Initially focused on Latin America, the group has expanded its operations to North America, South America, and Europe. The group targets a diverse range of industries, including IT, transportation, construction, materials, government entities, and critical infrastructure.
Attack Methods
Play ransomware uses various methods to gain entry into a network, including exploiting RDP servers, FortiOS vulnerabilities, and Microsoft Exchange vulnerabilities. The ransomware executes its code using scheduled tasks and PsExec, and employs tools like Mimikatz for privilege escalation. The group also uses custom tools to enumerate all users and computers on a compromised network and copy files from the Volume Shadow Copy Service (VSS).
Vulnerabilities and Impact
Williams Construction's extensive use of digital records and interconnected systems made it a prime target for the Play ransomware group. The attack has disrupted the company's operations and exposed sensitive client information, potentially leading to financial losses and reputational damage. The breach underscores the importance of implementing robust cybersecurity measures to protect against sophisticated ransomware attacks.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!