Fortune 500 Tech Giant ABB Hit With Ransomware

Swiss multinational technology, automation, and electrification giant ABB has been hit with the Black Basta ransomware. ABB is a Fortune 500 member, and provides ICS and SCADA systems for energy and manufacturing suppliers. They boast over 100,000 employees and an annual revenue of $29.4 billion.

"ABB operates more than 40 U.S.-based engineering, manufacturing, research and service facilities with a proven track record serving a diversity of federal agencies including the Department of Defense, such as U.S. Army Corps of Engineers, and Federal Civilian agencies such as the Departments of Interior, Transportation, Energy, United States Coast Guard, as well as the U.S. Postal Service," reads the ABB web site.

The ransomware attack purportedly infected the company's Active Directory, affecting hundreds of devices. The incident disrupted the company's operations, causing significant delays to projects and manufacturing timelines. ABB was forced to terminate VPN connections in response to the attack, in order to prevent the spread of the ransomware to customer networks.

"ABB recently detected an IT security incident that directly affected certain locations and systems," reads a statement from ABB. "To address the situation, ABB has taken, and continues to take, measures to contain the incident. Such containment measures have resulted in some disruptions to its operations which the company is addressing. The vast majority of its systems and factories are now up and running and ABB continues to serve its customers in a secure manner. ABB continues to work diligently with its customers and partners to resolve this situation and minimize its impact."

Since the Black Basta ransomware gang first came on the scene in April of 2022, the cybercriminals have been responsible for a string of attacks, including the American Dental Association, Knauf, Sobeys, and Yellow Pages Canada. In June 2022, they partnered with the QBot malware gang, and have been making use of Cobalt Strike to gain internal access to corporate networks. Most recently, the ransomware gang successfully attacked Capita, the U.K.'s largest outsourcing company.