Lockheed Martin, General Dynamics, Boeing and SpaceX are among dozens of companies named as victims of compromised data, accessed through the hacking of Visser Precision LLC, a Colorado-based aerospace, automotive and industrial parts manufacturer.

DoppelPaymer, a ransomware group, perpetrated the hack, according to Brett Callow, a threat analyst with Emsisoft.

[To see a photo (courtesy of Brett Callow/Emsisoft) posted to a hacker group website listing dozens of U.S. businesses whose data hackers claim to possess, click here.]

“Visser Precision, LLC was the recent target of a criminal cybersecurity incident, including access to or theft of data. The company continues its comprehensive investigation of the attack, and business is operating normally,” Visser Precision said in an emailed statement to Fifth Domain. “Visser Precision will continue full cooperation with its customer partner companies.”

The hacker group, which is a variant of actor BitPaymer, has been active for over a year but only recently began releasing compromised information, Callow said. The group’s website features an ominous message to “stay tuned” for a “LOT” more data to come “by parts.”

While threatening to release additional data, the group has already posted personnel information from industry corporations, government officials and subcontractors from 2016, as well as a partial document related to a missile antenna from Lockheed Martin from 2011.

“We are aware of the situation with Visser Precision and are following our standard response process for potential cyber incidents related to our supply chain,” a Lockheed Martin spokesperson told Fifth Domain. “Lockheed Martin has made and continues to make significant investments in cybersecurity, and uses industry-leading information security practices to protect sensitive information. This includes providing guidance to our suppliers, when appropriate, to assist them in enhancing their cybersecurity posture.”

Hacker groups — such as Maze, which previously released veterans’ sensitive information online — have targeted various government entities, law firms and businesses in the last year, as reported by Military Times, a sister publication of Fifth Domain.

Standard to other ransomware attacks, the hackers appear to have gained access to Visser Precision’s system, exfiltrating data before demanding payment to prevent a wider release.

“[The hackers] started by publishing older and less sensitive data,” Callow told Fifth Domain over email. “The more data they publish and the more sensitive that data is, the less incentive the company has to pay to prevent the remaining data being published.”

The Department of Defense recently announced an upcoming demonstration to test U.S. Air Force capabilities with SpaceX-developed Starlink technology. The released data, however, does not pertain to this platform.

SpaceX, General Dynamics and Boeing all did not immediately respond to requests for comments.

Callow, who monitors hackers’ activities, said DoppelPaymer has previously claimed in online posts to have stolen data in additional, unrelated incidents, and he believes more information will likely be released soon.

“This attack is particularly worrisome because of the nature of the information that may have fallen into the hands of cybercriminals,” Callow said. “Obviously, this [hack] could put the intellectual property of the companies’ concerned at risk and possibly even pose a risk to national security.”

The Federal Bureau of Investigation alerted businesses last October about “high-impact ransomware attacks” that specifically target government entities and corporations to encrypt data and unlock it for a fee, Fifth Domain previously reported.

In the last 48 hours, Maze separately published stolen information from a Canadian provincial government, state-owned Mexican petroleum company Pemex and a French telecommunications company, Callow added.

A 2019 Emsisoft report found that ransomware attacks targeted 113 state and municipal governments and agencies, 764 health care providers, and 89 universities, colleges and school districts nationwide.

Maze, a hacking and ransomware group, has breached several law firms, local government databases and other companies, demanding payments for data recovery and deletion. The posted information includes VA documents, patient care records, legal fee agreements and privacy consent forms.

Two of those hacks targeted Texas-based law firm Baker Wotring in November and Woods and Woods LLC in Evansville, Indiana, this month, the Evansville Courier & Press reported.

Woods and Woods is a nationwide disability benefits firm that deals with U.S. Department of Veterans Affairs litigation.

“[Woods and Woods LLC] has notified the FBI and has taken and continues to take prompt action to contain the incident, mitigate its effects, and fully investigate,” said Neil Woods in an emailed statement to Military Times. “The firm is able to continue conducting its business since it had backups in place. The firm will provide additional information to its clients as the investigation continues.”

It is unclear, however, whether clients from the firms are aware some of their sensitive information has already posted to the web.

Baker Wotring did not respond to a request for comment.

Maze hacks an organization’s servers, notifies them of the breach and demands ransom payments to prevent data dumps, according to Brett Callow, a threat analyst with Emsisoft. If the group does not receive payment, it will publish small amounts of compromised data — “proofs” — online, accessible to anyone with internet access.

The group has previously demanded payments ranging from $1 million to several million dollars, and if payment is not received, Maze will release additional sensitive data on a staggered basis, Callow explained. Maze has already released a portion of personal documents from Woods and Woods, and the group claims to have more information.

Maze has also posted the compromised data to a Russian hacker forum, Callow said.

In some cases, other hackers will use the stolen information to target and demand ransom from individual patients or clients. Maze itself wrote on its site, “Use this information in any nefarious way that you want,” Callow said.

Ransomware and malware breaches have become devastated organizations in recent years, often crippling their ability to function or demands extraordinary sums of money.

A 2019 Emsisoft report found that 113 state and municipal governments and agencies, 764 health care providers, and 89 universities, colleges and school districts nationwide.

These groups prefer to target smaller firms with less secure cybersecurity infrastructure, Callow previously told Law.com. The Federal Bureau of Investigation (FBI) issued a Flash Alert last month to private companies to notify them of increased Maze ransomware activities, BleepingComputer reported.