Japan Aviation Electronics Hit by Cyberattack: Servers Accessed in Security Breach

 

A cyberattack orchestrated by the notorious ALPHV ransomware group has been reported as a direct result of the catastrophic impact on the Japanese Aviation Electronics Industry (JAE). The BlackCat hackers have also been blamed for the attack. 

It was confirmed on November 6 that Japan Aviation Electronics was the victim of a cyberattack on November 2, 2023, which was officially confirmed the following day in an official press release. An external party had gained access to some of the company's servers without authorization from the Internet as a result of finding some servers inaccessible. 

It is unclear what type of data the cybercrooks might have gained access to and how many details the attackers provided about the breach. The ALPHV/Black Cat ransomware gang, which is a gang of cybercriminals, recently added Toyota Aviation Electronics to its list of leak websites, but the company has not yet confirmed whether it is a victim of a ransomware attack or not. 

Recent months have seen a spate of incidents targeting some of the country's biggest companies, with the latest attack occurring shortly after. In the past few months, many companies, including watchmaker Seiko, YKK, pharmaceutical company Eisai, and Japan's largest trading port, have been targeted by cybercriminals for ransomware attacks. 

An incident in January had a major impact on millions of Japanese customers, who had their personal information stolen by insurance firms Zurich and Aflac. The Japanese cybersecurity agency was breached by suspected Chinese hackers earlier this year, potentially allowing them access to sensitive data that had been stored on its networks for nine months and was potentially accessed by the hackers. 

The ALPHV/BlackCat ransomware gang claims to have stolen roughly 150,000 documents from the Japan Aviation Electronics company, including blueprints, contracts, confidential messages, and reports as part of the distribution of its ransomware. Japan Aviation Electronics has found no evidence of data exfiltration from its systems. 

On the Tor network, ALPHV/BlackCat has posted screenshots of allegedly stolen documents from Japan Aviation Electronics on its leaked website. These documents were allegedly stolen from Japan Aviation Electronics within the last 18 months. In response to the cyber-attack against Japan Aviation Electronics, an immediate investigation has been launched to determine the extent of the damage and the efforts being made to restore normal operations. 

There are several systems in the organization that have been temporarily suspended to mitigate the adverse effects of the attack. This has led to some delays in sending and receiving emails, despite the company's diligent efforts to mitigate these effects. 

ALPHV/BlackCat has been active since November 2021 and aims to profit from the ransomware-as-a-service (RaaS) model by exploiting the flaws in the DARPA RR-1 and .NET frameworks to execute ransomware. This first ransomware family written in Rust is likely to be connected to the Darkside gang, which is responsible for Blackmatter. 

As a group, the ALPHV/BlackCat group has been accused of exfiltrating victim data to have access to their customers' and employees' information for extortion purposes, deploying ransomware to encrypt their files, and engaging in extortion tactics such as distributed denial-of-service (DDoS) attacks and harassing them. 

A series of highly targeted cyberattacks have been perpetrated by this group in recent years, and over the years it has become known for its sophisticated and highly targeted attacks. It is common practice for so-called ransomware attacks to encrypt the victim's data and then demand a ransom payment to gain access to the decryption keys for the victim's data. 

Among a growing number of organizations that have been targeted by hackers such as these, the Japanese Aviation Electronics Industry is the latest victim to fall victim. Before this incident, the notorious ALPHV group had announced that Currax Pharmaceuticals had been added to their growing list of victims since it had been compromised by the ALPHV ransomware group. 

A cyberattack on the Institut Technologique FCBA in October 2023 expanded their victim list further. The cyberattack on FCBA was first reported when the ALPHV ransomware group listed the organization's website as a victim, but they added CBS Eastern Europe in the same month to their victim list as well. 

CBS Eastern Europe was the victim of a ransomware attack that was exposed by a hacker behind the ALPHV ransomware group, who complained that the company's response to the breach had not been adequate. 

They claimed responsibility for a cyberattack that took place in February of that year against Reddit, for infiltrations at Canadian software company Constellation Software and intrusions at Western Digital during June and May of 2023. 

Both the company as well as cybersecurity experts are closely monitoring the situation given the ongoing investigation into the cyberattack on Japan Aviation Electronics by the ALPHV ransomware group. Both companies are putting in place safeguards to make sure confidential data and sensitive information are not compromised. 

At the moment, the Japan Aviation Electronics Industry is refocusing on restoring its operations and preventing further interruptions, and the next few days will be crucial for assessing the impact of the attack and taking the necessary steps to prevent future security incidents. 

There is a growing interest among stakeholders in the extent of the breach and the potential impact that it may have on the business and its customers. Further details about this breach are eagerly awaited by stakeholders.