Wednesday, June 19, 2024

Defense contractor Hensoldt confirms Lorenz ransomware attack

Hensoldt, a multinational defense contractor headquartered in Germany, has confirmed that some of its UK subsidiary’s systems were compromised in a ransomware attack.

The defense multinational develops sensor solutions for defense, aerospace, and security applications is listed on the Frankfurt Stock Exchange and had a turnover of 1.2 billion euros in 2020.

It operates in the US under a special agreement that allows it to apply for classified and sensitive US government contracts. 

Its products include radar arrays, avionics, and laser rangefinders used on M1 Abrams tanks, various helicopter platforms, and LCS (Littoral Combat Ship) by the US Army, US Marine Corps, and the US National Guard.

Hensoldt announced on Thursday that it’s equipping German-Norwegian U212 CD submarines built by the kta consortium with next-generation fully digital optronics equipment.

While the company is yet to issue a public statement regarding this incident, the Lorenz ransomware gang has already claimed the attack.

On Wednesday, a Hensholdt spokesperson confirmed Lorenz’s claims after BleepingComputer reached out over email.

“I can confirm that a small number of mobile devices in our UK subsidiary has been affected,” Hensoldt’s Head of Public Relations, Lothar Belz, told BleepingComputer.

However, Belz denied providing additional information regarding the incident, saying that “for obvious reasons, we do not disclose any more details in such cases.”

Ransomware gang says they were paid

For its part, the Lorenz ransomware group claims to have stolen an undisclosed amount of files from Hensholdt’s network during the attack.

The gang says payment has been made, with 95% of all stolen files published on the ransomware’s data leak website since December 8, 2021, when the Hensoldt leak page was created.

Recommended:  UK: Holiday Inn hotels hit by cyber-attack

While Lorenz shows the leak as being “Paid,” it’s unclear if that means Hensoldt paid a ransom or if another threat actor purchased the data.

Lorenz Leak Page
Lorenz Leak Page

This is because the Lorenz ransomware gang is known for selling stolen data to other threat actors to pressure victims into paying ransoms.

If no ransom is paid after all data is leaked as password-protected RAR archives, Lorenz will also release the password to access the data leak archives to make the stolen files publicly available to anyone who downloads leaked archives.

This ransomware gang will also sell access to the victims’ internal networks to other threat actors along with any stolen data.

Lorenz began operating in April 2021 and has since been targeting enterprise organizations worldwide, demanding hundreds of thousands of dollars in ransoms from each of their victims.

In June, Dutch cybersecurity firm Tesorion released a free Lorenz ransomware decryptor, which victims can use to recover some file types, including Office documents, PDF files, images, and videos.

Return to Cybersecurity News

ClosePlease login
Share the word, let's increase Cybersecurity Awareness as we know it
- Sponsored -

Sponsored Offer

Unleash the Power of the Cloud: Grab $200 Credit for 60 Days on DigitalOcean!

Digital ocean free 200

Discover more infosec

User Avatar
Steven Black (n0tst3)
Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK. I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated... I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK. I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

more infosec reads

Subscribe for weekly updates