Ingersoll Rand Ransomware (2023)

Victim:

Ingersoll Rand

Attacker/Malware:

Stormus Ransomware

Industry:

Manufacturing

Estimated Cost:

~$5M-10M in losses, ~3% of data leaked publicly

Primary Attack Vector:

Likely Spear Phishing or Supply Chain compromise

Prevention Failure:

Weak Credentials, Lack of Segmentation

BlastWave Solution:

Network Cloaking, Passwordless Secure Access, and Segmentation

Kill Chain Analysis:

Standard Ransomware Targeting Data and Operations

In March 2023, Ingersoll Rand, a major manufacturer of compressors andindustrial tools, experienced a ransomware attack where attackers exfiltrated andleaked some stolen data.

The attack is believed to have used a general ransomware vector, exploitingzero-day vulnerabilities in a VPN system, but Stormus is also known for phishing and credential stuffing. This attack is notable for being quickly stopped andisolated, preventing it from spreading beyond the ~1TB of data exfiltrated.

BlastWave Prevention Analysis:

Decoupling Data Access from Operational Access

BlastWave enforces separation between the sensitive IT data (which was exfiltrated) and the critical OT control network.

The Zero Trust architecture would prevent the ransomware from reaching theindustrial control environment. At the same time, the IDM policy would havesegmented the data servers, limiting the amount of exfiltrated data by confining the attacker to a smaller, specific data segment rather than granting broadlateral access.

IDM policy would have segmented the data servers, limiting the amount of exfiltrated data by confining the attacker to a smaller, specific data segment rather than granting broad lateral access.

Download Hackopedia Volume 1 Now – It's Free

Our Privacy Policy applies.

Take the Next Step

Reading about past failures is only useful if it changes future outcomes. If attackers can see your OT network, they can target it. If they can target it, compliance, safety, and uptime are already at risk.

BlastWave eliminates reconnaissance, initial access, and lateral movement — without agents, without downtime, and without changing IPs, protocols, or PLCs.

Secure Your OT Network