A recent cyberattack on the aerospace and defense company Collins Aerospace, which has caused major disruptions at European airports, reportedly involved HardBit ransomware.
The HardBit ransomware, which first appeared in 2022, is unique because its operators are known to negotiate ransom amounts based on a victim's cyber insurance policy.
The Impact of the Attack
While the EU cybersecurity agency ENISA confirmed that the airport disruptions were the result of a ransomware attack, cybersecurity expert Kevin Beaumont reported that it involved a "basic" variant of HardBit. He noted that Collins Aerospace has been having trouble removing the malware, with some devices becoming reinfected after cleanup attempts.
The BBC reported that over one thousand computers may have been impacted and that the hackers were still inside the network even after systems were rebuilt. Ransomware expert Dominic Alvieri also confirmed HardBit's involvement but pointed out that it is an affiliate program, meaning anyone could have used it. He also mentioned that the notorious BianLian ransomware group targeted Collins Aerospace in 2023, possibly leaving a backdoor on the company's systems.
There was also some speculation that the ShinyHunters hacking group, or a related group like Scattered Spider, may have been involved.
Arrest Made in the UK
On Wednesday, the UK’s National Crime Agency (NCA) arrested a 40-year-old man in West Sussex as part of the investigation into the attack. The suspect was later released on bail, and the investigation is in its early stages. This comes after UK authorities recently arrested two Scattered Spider suspects.
The cyberattack on Collins Aerospace, which provides check-in and boarding systems, has affected major airports in the UK, Germany, and Belgium, causing flight delays and cancellations that have continued into Wednesday.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
