Atlas Air Denies Involvement in Everest Ransomware Attack Incident

Post Views: 2

US Cargo Airline Atlas Air Denies Ransomware Attack Claims

A recent claim by the Everest ransomware operation that it had breached the systems of Atlas Air, a major US cargo airline, has been disputed by the company. According to the ransomware group, 1.2 terabytes of sensitive technical data, including information related to Boeing aircraft, had been stolen. However, Atlas Air has denied that its systems were compromised.

Stolen Data Analysis

An analysis of screenshots purportedly showing the stolen data revealed a range of sensitive information, including aircraft maintenance and repair reports, logistics documents, and internal operational files. Additionally, a screenshot appeared to reference Malaysia Airlines, although it was unclear what connection this had to Atlas Air.

Possible Larger Operation

Researchers suggested that the attack may have been part of a larger operation targeting both Atlas Air and US aerospace firm Tsunami Tsolutions, which was also claimed to have been attacked by Everest. Screenshots of the data allegedly exfiltrated from Tsunami Tsolutions showed similar information to that supposedly stolen from Atlas Air.

“It’s possible that the attackers targeted both companies to increase their leverage in ransom negotiations,” said researchers. “However, it’s unclear which company may have been the initial entry point for the attackers.”

Ongoing Threat

The incident highlights the ongoing threat posed by ransomware operations, which continue to target organizations across a range of sectors. As the use of ransomware becomes increasingly sophisticated, companies must remain vigilant and take steps to protect themselves against these types of attacks.

Related Incidents

In a separate incident, Romanian oil pipeline operator Conpet recently disclosed that it had been the victim of a Qilin ransomware attack, which compromised its data. Meanwhile, the WorldLeaks ransomware operation has been linked to a new advanced malware strain known as RustyRocket, which has been used in a series of clandestine intrusions.