Incident
incident:threatlocker_manufacturing_ransomware_incident
Ransomware incident in which a manufacturing company lost access to 250 Windows servers and approximately 350 endpoints within fifteen minutes.
Ransomware incident in which a manufacturing company lost access to 250 Windows servers and approximately 350 endpoints within fifteen minutes.
“in the space of fifteen minutes it encrypted all 250 servers”
“it hit about 350 endpoints as well”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Kanti | Explicit | 167 |
| outgoing | INVOLVES | Windows | Explicit | 167 |
ThreatLocker manufacturing ransomware incident INVOLVES Kanti
The manufacturing-company incident involved Kanti ransomware, which renamed files with the .kanti extension and encrypted systems.
Explicit Confidence 99% · Guest EP 167 Details
“they all end in the word .kanti”
“in the space of fifteen minutes it encrypted all 250 servers”
ThreatLocker manufacturing ransomware incident INVOLVES Windows
The manufacturing-company incident encrypted all 250 Windows servers.
Explicit Confidence 98% · Guest EP 167 Details
“Yes, they were all Windows servers”