MS Ultrasonic Technology Group listed by Hunters ransomware group

• Ransomware group: Hunters
• Country: Germany
• Sector: Manufacturing
• Announcement date: July 15, 2024

The Hunters ransomware group has listed MS Ultrasonic Technology Group on its leak site, claiming that the organization has been targeted in a cyberattack. According to the announcement made by the threat actors, data belonging to the German company has been exfiltrated and encrypted, marking a significant escalation in the threat posed to the manufacturer.

Details of the claimed attack

On July 15, 2024, the Hunters ransomware group officially listed MS Ultrasonic Technology Group on its dedicated leak site. The group claims that they have successfully exfiltrated and encrypted a massive volume of data belonging to the organization. The scale of the alleged breach is substantial, with the group claiming to have obtained 3.7 TB of data, consisting of approximately 2,426,871 files.

The announcement indicates that a process for the publication of this stolen data may have already been initiated by the threat actors. This tactic is a hallmark of modern ransomware operations, often referred to as double extortion. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release the data publicly, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of confidential information.

While the group has made these claims, no ransom demand has been specified in the announcement. The presence of a listing on a leak site typically serves as a public warning to the victim and a signal to the broader community that the organization's defenses have been breached.

Data types and information involved

Based on the information provided by the attackers, the leaked data is highly sensitive and encompasses various levels of corporate and personal information. The breach appears to target both high-level executive files and general administrative records. Specifically, the leaked content is reported to include:

• CEO files
• HR data
• Passport information
• Driver's license information

The inclusion of such personal identification documents, such as passports and driver's licenses, significantly increases the severity of the incident. Such data is highly valuable on the dark web and can be exploited for various malicious purposes.

About MS Ultrasonic Technology Group

MS Ultrasonic Technology Group is a German-based company specializing in advanced manufacturing technologies. The organization develops and manufactures ultrasonic welding systems designed for joining plastics and metals. Their high-precision welding solutions are utilized across several critical industrial sectors, including the automotive, medical, and packaging industries.

Risk assessment and implications

The exposure of the claimed data poses several significant risks to the organization and its stakeholders. The theft of sensitive personal documents, such as passports and driver's licenses, creates a direct risk of identity theft for the organization's executives and employees. Furthermore, the exposure of corporate data may present serious risks regarding the security of trade secrets and the integrity of the organization's supply chain.

Because the organization is based in Germany, this incident may trigger specific legal obligations. Under the General Data Protection Regulation (GDPR), the company may face mandatory data breach notification requirements and potential administrative fines. The technical nature of the attack also provides insights into the threat actor; the group's use of the Hive codebase suggests that their technical infrastructure may share similar characteristics with that of the Hive ransomware group.

The historical activities of the Hunters ransomware group suggest that the stolen data could be utilized in secondary attacks, such as targeted phishing campaigns aimed at the company or its partners. In the manufacturing sector, such breaches can have cascading effects on supply chain security. To mitigate these risks, organizations in similar sectors often implement robust defense-in-depth strategies, including strict access controls, continuous monitoring, and comprehensive employee training to recognize social engineering attempts.