hensoldt

Defense contractor Hensoldt confirms Lorenz ransomware attack

Hensoldt, a multinational defense contractor headquartered in Germany, has confirmed that some of its UK subsidiary’s systems were compromised in a ransomware attack.

The defense multinational develops sensor solutions for defense, aerospace, and security applications is listed on the Frankfurt Stock Exchange and had a turnover of 1.2 billion euros in 2020.

It operates in the US under a special agreement that allows it to apply for classified and sensitive US government contracts. 

Its products include radar arrays, avionics, and laser rangefinders used on M1 Abrams tanks, various helicopter platforms, and LCS (Littoral Combat Ship) by the US Army, US Marine Corps, and the US National Guard.

Hensoldt announced on Thursday that it’s equipping German-Norwegian U212 CD submarines built by the kta consortium with next-generation fully digital optronics equipment.

While the company is yet to issue a public statement regarding this incident, the Lorenz ransomware gang has already claimed the attack.

On Wednesday, a Hensholdt spokesperson confirmed Lorenz’s claims after BleepingComputer reached out over email.

“I can confirm that a small number of mobile devices in our UK subsidiary has been affected,” Hensoldt’s Head of Public Relations, Lothar Belz, told BleepingComputer.

However, Belz denied providing additional information regarding the incident, saying that “for obvious reasons, we do not disclose any more details in such cases.”

Ransomware gang says they were paid

For its part, the Lorenz ransomware group claims to have stolen an undisclosed amount of files from Hensholdt’s network during the attack.

The gang says payment has been made, with 95% of all stolen files published on the ransomware’s data leak website since December 8, 2021, when the Hensoldt leak page was created.

Recommended:  Hackers breached China’s National Games ahead of last year’s competition

While Lorenz shows the leak as being “Paid,” it’s unclear if that means Hensoldt paid a ransom or if another threat actor purchased the data.

Lorenz Leak Page
Lorenz Leak Page

This is because the Lorenz ransomware gang is known for selling stolen data to other threat actors to pressure victims into paying ransoms.

If no ransom is paid after all data is leaked as password-protected RAR archives, Lorenz will also release the password to access the data leak archives to make the stolen files publicly available to anyone who downloads leaked archives.

This ransomware gang will also sell access to the victims’ internal networks to other threat actors along with any stolen data.

Lorenz began operating in April 2021 and has since been targeting enterprise organizations worldwide, demanding hundreds of thousands of dollars in ransoms from each of their victims.

In June, Dutch cybersecurity firm Tesorion released a free Lorenz ransomware decryptor, which victims can use to recover some file types, including Office documents, PDF files, images, and videos.

Return to Cybersecurity News

Bookmark
RiSec.n0tst3
Connect
Latest posts by RiSec.n0tst3 (see all)
Recommended:  Google Patches Zero-Day Vulnerability attack vector Actively Exploiting Chrome
Share the word, let's increase Cybersecurity Awareness as we know it

Leave a Comment

Your email address will not be published. Required fields are marked *

RiSec Captcha 17 + = 26