Dive Brief:
- Blue Yonder on Friday acknowledged it is investigating claims by a public threat group linked to the November ransomware attack.
- An emerging threat group dubbed Termite ransomware claimed credit for the Nov. 21 attack, saying it has 680GB of Blue Yonder data. Security researchers from Arctic Wolf said the claim was posted on a leak site that has only been in operation since October.
- Blue Yonder – which initially described the attack as ransomware – said it is working closely with outside forensic experts to address the claims. Its investigation into the attack is ongoing, the company said.
Dive Insight:
While it is unclear whether Termite ransomware is an offshoot of a prior group, researchers from Broadcom said the group appears to use a modified version of Babuk ransomware.
Termite ransomware uses a double extortion method, extorting victims for a decryptor in order to prevent the release of stolen data, researchers from Kroll found.
Kroll researchers observed Termite use a watering hole attack method that relied on malicious ad software, according to Laurie Iacono, associate managing director, cyber risk at Kroll.
“In the case Kroll observed, the user was infected with the information stealing malware, Red Line Stealer, to collect credentials,” Iacono said via email. “Ransomware was deployed inside a VMware ESXi environment."
It is not known whether any of these techniques were used in connection with the Blue Yonder attack.
Blue Yonder said it has notified customers that were impacted by operational disruptions and has been working with them throughout the process of restoration. On Friday, U.K.-based supermarket chain Morrisons, told Cybersecurity Dive that it had restored normal operations and that its internal backup systems were online.
Morrisons, which has about 500 stores across the U.K., said the attack disrupted the company’s warehouse management system for produce and fresh food.
Starbucks was impacted, too, and had to revert to manual scheduling after a Blue Yonder platform it uses to keep track of employee hours was disrupted by the attack.
