Cybercriminal group Everest is demanding 10 million Swiss francs ($12.3 million) from Swiss rail vehicle manufacturer Stadler after breaching a data exchange platform shared with one of its suppliers through compromised credentials.
Stadler operates 16 production and component plants and eight engineering centers, backed by a global service network of more than 95 locations, and employs over 17,100 people from over 75 countries.
The Swiss company confirmed it received an extortion letter in which the Everest ransomware gang claimed responsibility and demanded 10 million Swiss francs.
“Under no circumstances will Stadler pay a ransom,” the manufacturer said, adding that it is therefore not susceptible to extortion.
The company has filed a criminal complaint with the Thurgau Cantonal Police.
According to the company’s disclosure, the incident occurred in mid-July and did not affect its IT systems or production operations. The company added that the attackers accessed only technical information belonging to a supplier that is not safety-relevant, with no relevant personal data stolen and no impact on its rail vehicles operating worldwide.
Everest emerged in December 2020 with a focus on data exfiltration without encryption, primarily targeting Canadian organizations.
Since then, it has evolved into a hybrid operation, acting as both a ransomware group and an initial access broker that sells stolen network credentials to other criminals, while also running a recruitment scheme that pays company insiders for direct access to their employers’ networks.
Everest has also claimed responsibility for disruptions at several major European airports, including Heathrow, Brussels, Berlin, Dublin, and Cork.
Rail industry digitization is likely to make the sector a more frequent target for criminal groups in the years ahead.
Click Here For The Original Source.
