Airplane Manufacturing Giant Bombardier Suffers Cyber Attack

As Cybercrime takes the centrestage in today’s world, criminals are targeting everything they can get their hands on, including giant companies like Bombardier, a Canada-based airplane manufacturing company.

Bombardier has reported that a major data breach struck the company when some of its sensitive data were published on the Dark Web. A portal built and operated by the Clop ransomware gang has published this sensitive data.

In a press release, the company spokesperson stated that the unauthorized party was able to gain access and steal the data by exploiting a vulnerability in a third-party file transfer application. 

Turns out that Bombardier was not the only company that was attacked. Accellion FTA is a web server that is used by organizations to share large files that can’t be normally sent via emails. In December 2020, a group of attackers was able to identify a zero-day in the FTA Server and exploited it to attack companies all over the globe. They first gained access to the company systems, ran a shell script, and then stole the companies’ sensitive data. The attackers then proceeded to blackmail the companies by asking for money and threatening to make the data available to the public. 

Accellion has stated that out of 300 customers that are running its servers, 100 got targeted and 25 suffered from data breaches and ransomware attacks. 

The portal operated by the Clop ransomware gang has published the data of companies like Danaher, Fugro, Singtel, and Jones Day so far. Bombardier’s data was also published to the website recently. 

After this incident only, Bombardier spokesperson decided to go public with the company’s situation. In the case of Bombardier, this published data includes the designs and plans of airplane parts.  

It is being assumed that this incident is part of a large hacking campaign being operated by a major cybercrime group. In an official report, FireEye stated that all these attacks trace back to one big cybercrime organization that is being tracked as FIN11. 

FIN11 is a cybercrime group that was involved in a lot of cybercrimes that happened last year.