By Gregory Hale
Lampa, Santiago, Chile-based plastic packaging manufacturer Fosko S.A. suffered a ransomware attack in September where the incident disrupted the company’s digital infrastructure but did not shut down its manufacturing operations entirely.
The hack, which was a LockBit 3.0 ransomware attack, compromised production equipment, shared files two local workstations, a primary file server, and disrupted access to critical billing files.
Security experts tied the reported September 26 incident to LockBit 3.0, a known ransomware-as-a-service (RaaS) operation. The incident ended up discovered when a user could not access billing files.
Fosko has nearly 60 years of experience, established in national and international markets. With automated systems, the company offers cutting-edge packaging solutions, including oxygen and light barrier labeling.
Not Thinking of Security
In the plastic packaging manufacturing and distribution industry, cybersecurity is rarely at the center of the conversation. To that end, manufacturing companies prioritize operational continuity and investment in machinery over the modernization of their technological infrastructure.
This was what occurred at Fosko after years of operating under the same setup, minimal infrastructure, Windows servers, a firewall with a basic configuration, and the most elementary versions of endpoint protection solutions, according to a report on Trendtic.cl.
“For years, technology investment was limited to the bare minimum, based on the assumption that we had never experienced a serious incident. We operated with basic configurations and lacked testing environments to validate updates. As long as everything was running, there was no perceived urgency to invest in security—even though the risk was always there,” said Jonathan Díaz, a systems analyst at Fosko in the Trendtic.cl report.
Díaz said in the report when he took charge of the IT department, there were no formal reports on the status of the servers, nor was there any clear traceability of configurations, which made it necessary to rebuild the entire technology landscape from scratch.
There was also a lack of development environments for testing updates without impacting live operations.
“When we evaluated the replacement of our servers, switches, and firewalls, we looked for vendors who would not just provide a quote for the basics, but also account for future growth,” Díaz said. “We wanted to ensure that if the network expanded or if we upgraded to faster switches, the firewall wouldn’t become a bottleneck.”
Isolated the Attack
The incident ended up detected when a user in the warehouse department could no longer access key files required for invoicing. Upon reviewing the alert, Díaz confirmed the presence of ransomware and immediately isolated the compromised equipment to prevent it from spreading.
LockBit 3.0 completely encrypted one machine and reached a shared folder on a file server, spreading to another computer that had access to the same path. In total, two workstations ended up encrypted, and one server partially affected.
“The ransomware seeks out privileges to move laterally. It detected a folder with broad permissions and expanded from there, but we managed to identify the pattern in time,” Díaz said in the report.
No further information was immediately available on how much the attackers were seeking.
For more information on other incidents in the industry click on ICSSTRIVE.com.