Flash Report: NEW Cooperative Ransomware Attack

Flash Report: NEW Cooperative Ransomware Attack

TLP: GREEN

On September 19th, 2021, the large Iowa based agricultural business, NEW Cooperative, took systems offline after suffering a ransomware attack from the BlackMatter ransomware group. The ransomware group is demanding 152.29 Bitcoin (5.9 Million USD) before providing the decryption key, as well as threatening to double the ransom amount if payment is not made by September 25th. Due to the nature of the services provided by NEW Cooperative, the attack threatens to disrupt the US food industry and distribution.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Maintain regular offsite backups to protect against data encryption, corruption, and natural disasters.
• Files stolen in ransomware attacks can often be sizable. Establish a detection rule for files leaving the network of an above average size, particularly in a compressed format such as .zip, .rar, .tar, .7z, or .gz

Details

BlackMatter is a well known and prolific ransomware group specialising in double extortion, where data is stolen before systems are encrypted. The group's [.]onion data leak site publicly lists new victims. Each victim page includes a countdown timer showing the victim the remaining time left to pay the ransom before releasing all exfiltrated data publicly. The group also claims they do not target critical infrastructure.

Figure 1: Screenshot of BlackMatters victim page for NEW Cooperative

In leaked communications between the group and NEW Cooperative however, NEW Cooperative argue they are classed as critical infrastructure as almost 40% of all grain production in the US runs on their software, along with millions of animal feed schedules being disrupted as a result of the attack. NEW Cooperative also explained the "impact of this attack will likely be much worse than the pipeline attack for context," in reference to the Colonial Pipeline attack in May, which saw massive disruption to oil distribution across the US. BlackMatter have responded by saying NEW Cooperative "do not fall under the rules,” and as such are not eligible for free decryption. The US federal government lists "food & agriculture" as one of the nation's critical infrastructure sectors, which would indicate NEW Cooperative is classified as critical to the US government.

Figure 2: Negotiation between BlackMatter and NEW Cooperative

The stolen data comprises approximately 1000GB of information, with samples attached to the NEW Cooperative victim page on the BlackMatter group’s site. According to BlackMatter, the data contains:

• Financial information containing invoices and payroll data
• IT Network information for all companies within the group
• Internal knowledge base data
• Encrypted password vaults
• HR and personally identifiable information on employees
• Product and research and development information
• Source code for several products

NEW Cooperative, as of writing, has not made any payments to recover data despite threats from the BlackMatter group negotiator that the ransom amount will be doubled. The attack also coincides with the US Department of the Treasury releasing an updated advisory on potential sanctions for facilitating ransomware payments, which reiterates that making ransomware payments may violate Office of Foreign Assets Control (OFAC) regulations and result in civil penalties.

Indicators

SHA256: 706f3eec328e91ff7f66c8f0a2fb9b556325c153a329a2062dc85879c540839d
BTC Wallet: bc1qy9rg63g5zmkyxl9jp3z4szdxe8ayp3x5hq2p4p