Lockheed Martin, General Dynamics, Boeing and SpaceX are among dozens of companies named as victims of compromised data, accessed through the hacking of Visser Precision LLC, a Colorado-based aerospace, automotive and industrial parts manufacturer.

DoppelPaymer, a ransomware group, perpetrated the hack, according to Brett Callow, a threat analyst with Emsisoft.

[To see a photo (courtesy of Brett Callow/Emsisoft) posted to a hacker group website listing dozens of U.S. businesses whose data hackers claim to possess, click here.]

“Visser Precision, LLC was the recent target of a criminal cybersecurity incident, including access to or theft of data. The company continues its comprehensive investigation of the attack, and business is operating normally,” Visser Precision said in an emailed statement to Fifth Domain. “Visser Precision will continue full cooperation with its customer partner companies.”

The hacker group, which is a variant of actor BitPaymer, has been active for over a year but only recently began releasing compromised information, Callow said. The group’s website features an ominous message to “stay tuned” for a “LOT” more data to come “by parts.”

While threatening to release additional data, the group has already posted personnel information from industry corporations, government officials and subcontractors from 2016, as well as a partial document related to a missile antenna from Lockheed Martin from 2011.

“We are aware of the situation with Visser Precision and are following our standard response process for potential cyber incidents related to our supply chain,” a Lockheed Martin spokesperson told Fifth Domain. “Lockheed Martin has made and continues to make significant investments in cybersecurity, and uses industry-leading information security practices to protect sensitive information. This includes providing guidance to our suppliers, when appropriate, to assist them in enhancing their cybersecurity posture.”

Hacker groups — such as Maze, which previously released veterans’ sensitive information online — have targeted various government entities, law firms and businesses in the last year, as reported by Military Times, a sister publication of Fifth Domain.

Standard to other ransomware attacks, the hackers appear to have gained access to Visser Precision’s system, exfiltrating data before demanding payment to prevent a wider release.

“[The hackers] started by publishing older and less sensitive data,” Callow told Fifth Domain over email. “The more data they publish and the more sensitive that data is, the less incentive the company has to pay to prevent the remaining data being published.”

The Department of Defense recently announced an upcoming demonstration to test U.S. Air Force capabilities with SpaceX-developed Starlink technology. The released data, however, does not pertain to this platform.

SpaceX, General Dynamics and Boeing all did not immediately respond to requests for comments.

Callow, who monitors hackers’ activities, said DoppelPaymer has previously claimed in online posts to have stolen data in additional, unrelated incidents, and he believes more information will likely be released soon.

“This attack is particularly worrisome because of the nature of the information that may have fallen into the hands of cybercriminals,” Callow said. “Obviously, this [hack] could put the intellectual property of the companies’ concerned at risk and possibly even pose a risk to national security.”

The Federal Bureau of Investigation alerted businesses last October about “high-impact ransomware attacks” that specifically target government entities and corporations to encrypt data and unlock it for a fee, Fifth Domain previously reported.

In the last 48 hours, Maze separately published stolen information from a Canadian provincial government, state-owned Mexican petroleum company Pemex and a French telecommunications company, Callow added.

A 2019 Emsisoft report found that ransomware attacks targeted 113 state and municipal governments and agencies, 764 health care providers, and 89 universities, colleges and school districts nationwide.

The Lithuanian Court of Appeal in Vilnius ruled that Evaldas Rimasauskas must be handed over to the U.S., where he will be tried for wire fraud, money laundering and aggravated identity theft. He allegedly posed as one of the companies’ suppliers, an Asian computer hardware manufacturer, and tricked them into accepting fraudulent invoices. Google earlier said it had detected the fraud and alerted authorities.

Rimasauskas has denied the charges. If convicted, he could face a lengthy prison sentence.

“Lithuania has a bilateral extradition agreement with the U.S. and this case meets all criteria,” judge Algimantas Valantinas told reporters. “The United States has launched an investigation into this crime, so the request to hand over this citizen of Lithuania was legitimate and motivated.”

Rimasauskas’ lawyer, Linas Kuprusevicius, said his client “cannot expect a fair and impartial trial in the United States,” and claimed the extradition request lacked key information, but the court dismissed these statements.

Friday’s decision is final. A date for the handover will be announced later this month.

AW North Carolina stood to lose $270,000 in revenue, plus wages for idled employees, for every hour the factory wasn’t shipping its crucial auto parts to nine Toyota car and truck plants across North America, said John Peterson, the plant’s information technology manager.

The company is just one of a growing number being hit by cyber-criminals looking for a payday.

While online thieves have long targeted banks for digital holdups, today’s just-in-time manufacturing sector is climbing toward the top of hackers’ hit lists.

Production lines that integrate computer-imaging, barcode scanners and measuring tolerances to a hair’s width at multiple points are more vulnerable to malevolent outsiders.

“These people who try to hack into your network know you have a set schedule. And they know hours are meaningful to what you’re doing,” Peterson said in an interview. “There’s only a day and a half of inventory in the entire supply chain. And so if we don’t make our product in time, that means Toyota doesn’t make their product in time, which means they don’t have a car to sell on the lot that next day. It’s that tight.”

He said that creates pressure on manufacturers to make the criminals go away by paying the sums demanded.

“They may not know what that number is, but they know it’s not zero. So what is that number? Where do you flinch?”

Last August at the 2,200-worker Durham transmission factory, the computer virus coursed through the plant’s network, flooding machines with data and stopping production for about four hours, Peterson said.

Data on some laptops was lost, but the malware was blocked by a firewall when it tried to exit the plant’s network and put the hackers’ lock on the plant’s computer network.

The plant was hit again in April, this time by different crooks using new malware designed to hold data or devices hostage to force a ransom payment, Peterson said. The virus was contained before affecting production, and no ransom was paid to either group, he said.

Manufacturers, government and financial firms are now the top targets globally for illicit intrusions by criminals, foreign espionage agencies and others up to no good, according to a report this spring by NTT Security.

A survey of nearly 3,000 corporate cybersecurity executives in 13 countries last year by Cisco Systems Inc. found about one out of four manufacturing organizations reported cyberattacks that cost them money in the previous 12 months.

Since 2015, U.S. manufacturers considered “critical” to the economy and to normal modern life, like makers of autos and aviation parts, have been the main targets of cyberattacks — outstripping energy, communications and other critical infrastructure, according to Department of Homeland Security incident response data. The numbers may be imprecise because companies in key industries often don’t report attacks for fear of diminished public perception.

But attacks demanding ransom against all U.S. institutions are spiraling higher. The FBI’s Internet Crime Complaint Center received 2,673 ransomware reports in the year ending last September — nearly double from 2014.

While manufacturers are increasingly prey to these cyber-stickups, it may just be because criminals are playing the odds and striking as many enterprises of all types as they can across a targeted region, said John Miller, who heads a team at cybersecurity firm FireEye that tracks money-driven online threats.

Attackers “aren’t necessarily going after manufacturing to the exclusion of other sectors or with a preference above other sectors. It’s more that, ‘OK, we’re going to try to infect everybody in this country that we can,’” Miller said.

One high-profile example came in May and June, when auto manufacturers including Renault shut down production after they were swept up in the worldwide onslaught of the WannaCry ransomware virus.

But attackers also are increasingly injecting ways to remotely control the robots and other automated systems that control production inside targeted factories.

The threat of computer code tailored to hit specific targets has been around since researchers in 2010 discovered Stuxnet, malware apparently designed to sabotage Iran’s nuclear program by causing centrifuge machines to spin out of control. Stuxnet is widely believed to be a covert American and Israeli creation, but neither country has officially acknowledged a role in the attack.

Malicious software that attacked Ukraine’s electricity grid last December was built to remotely sabotage circuit breakers, switches and protection relays, researchers said.

Cyberattacks that reach into industrial control systems have doubled in the past two years in the U.S. to nearly four dozen so far in the federal fiscal year that ends in September, outstripping last year’s total, according to DHS data.

“I think the emerging threat you’re going to see in the future now is really custom ransomware that’s going to be targeted more toward individual companies,” said Neil Hershfield, the acting director of the DHS team that handles emergency response to cyberattacks on industrial control systems.

Since different organizations may have different goals and priorities for their programs, a framework acts more as a rubric, providing considerations and guidance rather than authority. This assistance reduces the likelihood that activities will result in violating the Computer Fraud and Abuse Act.

For more information, or to read the steps in detail go here.

An Alaska Airlines spokeswoman said Monday that the company noticed unusual activity in Virgin’s systems in March and notified law enforcement and hired cybersecurity experts. She said customer information wasn’t affected but employees and contractors will be required to change passwords every 90 days.

About 3,100 employees may have had their login information stolen, the airline said. Another 110 also had personal information compromised, including addresses, Social Security numbers and health-related information. The airline is paying for credit-monitoring services for those 110 employees and contractors.

Alaska bought California-based Virgin America last year.

A letter to Virgin America employees from Kyle Levine, general counsel of Seattle-based Alaska Air Group Inc., was posted on the California attorney general’s website last week.

Levine said the hacker or hackers gained employees’ login information and passwords to Virgin America’s network. He offered advice for employees who think they might be victims of identity theft.

Speaking at the annual Black Hat conference in Las Vegas, Tom Grasso, supervisory special agent with the FBI’s Cyber Division, continually reiterated the bureau’s interest in working with the private sector, particularly when working with complex threats like botnets.

“Our overall botnet strategy really starts with the private sector … I’m looking to my private sector partners to tell me where the threats are,” he told the roomful of hackers – both white and black hat. “You guys are down in the trenches, you’re fighting the fight every day, so I want you to tell me what those threats are.”

Grasso cited the bureau’s work taking down the GameOver ZeuS botnet, ultimately dismantled by the FBI in 2014.

That network was so complex, Grasso said he had all but given up on defeating it. That resignation lasted two years, until an industry partner came to the FBI with a method of attack.

“He basically laid out the plan for us and then we put that plan into action with court orders and legal processes,” he said. “For those of you who have really good ideas on how to do things … and you maybe want to go and take the threat down yourself but you think, ‘I don’t know, it might not be quite legal,’ … we can make it legal for you to do that.”

Though lawmakers have proposed legislation that would legalize some level of “hacking back” – going after the attackers directly – those have yet to be enacted and top federal and law enforcement officials continually warn against private citizens taking vigilante action.

However, by teaming up with the FBI, individuals can do just that within the proper legal frameworks.

“We can take your good ideas and we can put them into action,” Grasso said.

“I’m not going to tell you [the FBI] is the savior of the internet,” Grasso said during a briefing at the 2017 Black Hat convention in Las Vegas. “We’re not. You all are – we all are, actually, is what it comes down to.”

Grasso explained the bureau’s three-pronged approach to defeating botnets, which include neutralizing the threat actors, disabling the underlying infrastructure through active operations and mitigating the effects of malicious activity by sharing indicators of compromise across relevant sectors.

“We do more than just arrest the bad guys,” Grasso said. “The tools we have in law enforcement for identifying criminals and taking them out of action – that’s important – but there’s other things that we can do, as well.”

Neutralize

The more traditional law enforcement approach: Identify the bad guy and take them down.

“Find the people that are operating these things, take them off the playing field so they can’t continue to do the damage that they do,” Grasso said.

Mitigation

In every instance, the FBI wants to limit the amount of damage these actors and perpetrate. Most of those mitigation efforts center on sharing information with industry and relevant sectors.

“We can share intelligence with the private sector, and maybe the private sector can do mitigation and develop a technical solution,” he said.

If researchers in the private sector – whether in industry or independent – discover patches or technical solutions that make the attack vectors moot, “They’ve effectively defeated it and it’s not necessary for us to come in and do our thing from the law enforcement side.”

Technical Operation

“The last thing we can do, is kind of the sexy thing that everyone likes to talk about, which is a botnet takedown,” Grasso said. “Sometimes we can, by working with our private sector partners, do some kind of technical operation, some type of intervention where we go and take this threat away from the criminals and direct it somewhere safe, and then work on mitigation.”

The key to all of this, Grasso explained, is cooperation with the private sector.

In a notice posted on the FedBizOpps contracting website titled “Aviation Electronic Warfare and Cyber Warfare Capability Development,” the Army is looking for potential contractors to support three high level objectives for the Aviation Center of Excellence at Fort Rucker in Alabama;

1. Approved electronic warfare and cyber warfare aviation concept of operations that can be valid through fiscal 2035;
2. Approved Aviation EW and cyber warfare required capabilities integrated and synchronized across doctrine, organization, training, materiel, leadership and education, personnel, facilities and policy (DOTMLPF-P); and
3. Approved Army EW and cyber warfare capability synchronized and integrated on and with aviation manned and unmanned platforms along with other aviation systems.

Among other elements contractors will be required to provide, the draft statement outlines that the contractor will review existing threat force concepts and capabilities while studying trends and emerging technologies as well as providing subject matter experts for the development of EW and cyber warfare aviation concepts of operations.

Shares of FedEx fell 3.4 percent Monday morning but recovered about half by the close of trading.

FedEx said in a regulatory filing that the June 27 attack was causing lost revenue and higher costs for Netherlands-based TNT, which FedEx bought for $4.8 billion last year.

The so-called Petya attack spread a virus through a Ukrainian tax-software product that was used by TNT. FedEx said that all TNT facilities were running but many tasks were being performed manually and customers were experiencing delays.

Memphis-based FedEx, which first reported the attack on June 28, said systems in the rest of its businesses were not affected. The company said it did not have insurance to cover the attack.

Shares of FedEx closed Monday down $3.58, or 1.6 percent, to $215.48.