Supply chain attack lets ransomware group inside 40+ shipping companies - Risky Biz
A ransomware group named n0n has breached over 40 maritime companies through a supply chain attack, likely originating from South Korean IT provider CyberLogitec.
The n0n ransomware group has successfully executed a major supply chain attack, compromising the networks of more than 40 port authorities, maritime companies, and global sea shipping operators. All victims were listed on n0n's dark web leak site on October 12, with final payment deadlines expiring a week later on October 19.
Security firm CyDome has identified that half of the affected companies are known customers of CyberLogitec, a South Korean provider of IT platforms for the maritime sector. The prolonged downtime of CyberLogitec's website strongly suggests the company is the source of this widespread hacking spree.
The ransomware group is demanding a staggering total of $1.2 billion from its victims. Most companies have refused to pay, resulting in their data being leaked on the dark web site. The attacks span 18 countries and include various maritime-related organizations from container port operators to ship managers and ocean exploration companies.
Scale of attack
This incident stands as one of the largest cyberattacks to hit the maritime sector since the notorious NotPetya ransomware attack in 2016. The n0n group launched its operations in mid-September and has already listed over 140 victims on its leak site.
The group would have ranked as the third-most active ransomware operation in Q3, surpassing many established groups in just a few months of operation.
Industry impact
The attack highlights the growing vulnerability of supply chains in critical infrastructure sectors. Maritime operations, which form the backbone of global trade, are particularly attractive targets for ransomware groups due to their interconnected nature and potential for widespread disruption.
The incident is one of the largest cyberattacks to hit the maritime sector since the NotPetya ransomware in 2016.
The attack follows a concerning trend of increased targeting of maritime and logistics companies by cybercriminal groups. These organizations often manage vast amounts of sensitive data and play crucial roles in global supply chains, making them high-value targets for extortion and data theft.
Related
