Back to threat feeds
Cyberattack
Boeing Hacked! Lockbit Ransomware Threatens To Leak If No Ransom On Time
LockBit ransomware breaches Boeing's defenses, posing an unprecedented security threat. Critical implications unfold
Continue reading
LockBit ransomware breaches Boeing's defenses, posing an unprecedented security threat. Critical implications unfold
Continue reading
The Boeing Company, with a staggering annual revenue of $66.61 billion and a workforce comprising 156,000 employees (as of 2022), has been allegedly targeted by the LockBit ransomware group. This claim poses a security concern and demands immediate attention, given LockBit's status as one of the most active ransomware groups worldwide. This breach declared on the group's dark web leak site, stipulates a substantial amount of sensitive data being held for ransom.
LockBit, renowned for its sophisticated ransomware operations, alleges a zero-day exploit breach into Boeing’s infrastructure according to vx-underground. The claims, however, lack substantiated evidence, compelling the cybersecurity community to await further verifiable information.
*Screenshot of the data leaked site of LockBit*
The communication posted by the infamous threat group on its leak site describes Boeing, and its subsidiarie involved in the comprehensive spectrum of activities, including designing, developing, manufacturing, selling, servicing, and supporting commercial jetliners, military aircraft, satellites, missile defense, human space flight, and worldwide launch systems and services.
The group claims to have accessed a substantial volume of sensitive data, poised for release unless Boeing contacts them before the deadline. While they currently refrain from sharing lists or samples to shield the company, this approach will change as the deadline approaches. Amid this turbulence, LockBit altered its modus operandi, shortening the response window for Boeing from the usual 10 days to an alarming six-day ultimatum. The threat suggests the potential publication of the purportedly exfiltrated sensitive data if Boeing fails to comply.
*Details of this target*
Brett Callow, a security expert, accurately highlighted that the LockBit group has previously included companies on their list, even though they were actually a vendor associated with the compromised company.
At present, the specific ransom demand for Boeing remains undisclosed; however, analyst Dominic Alvieri anticipates it to potentially be substantial
Boeing, an entity pivotal to global aviation and defense, remains in the evaluation phase, refraining from confirming or refuting LockBit’s assertions. This silence might be attributed to the uncertainty surrounding the scale and severity of the breach.
Notably, LockBit’s history unveils sporadic adherence to its threats, often due to internal organizational challenges. Instances exist where the group did not follow through on its data publication promises, indicating potential inconsistencies in their claims.
LockBit’s trajectory in the cybercrime landscape dates back to its emergence in Russian-language forums in early 2020. Their notorious ransomware activities, amounting to approximately 1,700 attacks on American entities, have landed them in the limelight.
The group’s ransomware variant, LockBit 3.0, recognized for its evasiveness, exhibits a sophisticated modus operandi, gaining initial access via various means like RDP exploitation, phishing campaigns, and exploiting public-facing applications.
The variant's infiltration methodology reveals a multi-faceted approach encompassing remote desktop protocol exploitation, phishing, and abuse of valid accounts, aligning with previously reported ransomware tactics.
LockBit's payment collection, estimated in Bitcoin, indicates substantial monetary gains. However, recent reports suggest the group is entangled in internal management issues, leading to a decreased adherence to their threats of data publication, as observed from February to June this year.
Boeing’s current phase of assessment underscores the challenges in validating the claims made by ransomware perpetrators. The intricate nature of cyber threats demands a comprehensive approach, ensuring the accuracy of breach assessments.
Such high-profile breaches within the aerospace industry are not only a concern for individual companies like Boeing but also pose a larger threat to national security and global stability. Swift and effective action is imperative, balancing the confidentiality of sensitive data with timely response strategies.
A new development in the Boeing cyberattack reveals that the aerospace company is currently involved in a cyberattack investigation, primarily affecting its parts and distribution business.
Boeing has assured the public that the cyberattack incident did not compromise any flight safety. The company, in collaboration with law enforcement and regulatory bodies, is actively engaged in an ongoing investigation to ascertain the extent and impact of the breach. At present, the Boeing services website is inaccessible, displaying a notice attributing the outage to "technical issues." Despite the current disruption, Boeing has explicitly stated that the ongoing situation has no bearing on flight safety.
*Screenshot of Outage*
LockBit previously claimed responsibility for targeting Boeing's network, affirming the theft of a substantial amount of sensitive information. However, Boeing has yet to validate the connection between LockBit’s claims and the cyberattack incident affecting its systems. The ransomware group had initially threatened to leak the stolen data online if Boeing failed to comply within a specified deadline. Intriguingly, the data leak page on the cybercrime operation’s dark website has been removed, signaling potential negotiations or payments with the ransomware gang.
U.S. Army recruiting pages hijacked to display fake 404 errors reading ‘Kurdistan’, exploiting a third-party tool and exposing .mil web security gaps.
