CK Power Public Manufacturing targeted by hunters ransomware group

• Ransomware group: hunters
• Country: Thailand
• Sector: Energy & Utilities
• Announcement date: November 20, 2024

The threat actor known as hunters has listed CK Power Public Manufacturing on its leak site, claiming that the organization has fallen victim to a cyberattack. According to the announcement made on November 20, 2024, the group alleges that data belonging to the company has been exfiltrated from its network and that various systems within the organization have been encrypted.

Details of the claimed attack

The listing on the hunters leak site serves as a formal announcement regarding the group's activities involving the target. The threat actor claims that the attack occurred on November 20, 2024, the same day the incident was posted online. According to the group's claims, the intrusion involved both the theft of information and the encryption of systems, a combination often associated with double extortion tactics.

In a double extortion scheme, attackers typically aim to maximize their leverage by threatening to release sensitive information if a ransom is not paid, in addition to the disruption caused by encrypting the victim's files. This approach places significant pressure on organizations to comply with demands to avoid the public exposure of their internal data.

Data involved in the incident

Regarding the specific content of the breach, there is no detailed information provided by the group concerning the specific types of data allegedly exfiltrated. While a screenshot associated with the listing indicates that data has been exfiltrated and encrypted, the exact nature of the files remains unknown.

The listing names no specific data types.

Organization profile

CK Power Public Company Limited is a Thailand-based energy production company. The company operates in the generation and distribution of electricity through hydroelectric, solar, and cogeneration power plants.

Impact and assessment

The activities of the hunters group may negatively impact the operational continuity of CK Power Public Manufacturing and could lead to significant service disruptions. The exfiltration of data may pose a risk of exposing trade secrets or employee information. Furthermore, given the nature of the incident, it is likely that the organization will face legal obligations under Thailand's data protection regulations.

The hunters group is assessed to be derived from Hive code, which suggests they may engage in secondary extortion attempts using similar methods. It is worth noting that Hunters International is a group that emerged in 2023 and has been reported to have announced the cessation of its encryption activities in 2025.

For organizations operating within the energy and utilities sector, such attacks highlight the critical importance of robust cybersecurity frameworks. To mitigate the risks posed by ransomware groups, organizations often implement defensive measures such as regular offline backups, network segmentation to prevent lateral movement, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, maintaining a comprehensive incident response plan is vital for managing the operational and legal consequences of a successful breach.