Akira attacks CLX Logistics

Incident Date: Sep 25, 2023

Attack Overview
VICTIM
CLX Logistics
INDUSTRY
Transportation
LOCATION
USA
ATTACKER
Akira
FIRST REPORTED
September 25, 2023

The Akira Ransomware Gang's Attack on CLX Logistics

The Akira ransomware gang has attacked CLX Logistics. CLX Logistics, also known as CLX Logistics, LLC, is a logistics and transportation management company that provides a range of supply chain solutions and services to businesses across various industries. CLX Logistics is headquartered in Blue Bell, Pennsylvania, USA, and has a global presence, serving clients worldwide. The company specializes in optimizing supply chains, managing transportation, and providing consulting services to help businesses enhance their logistics and transportation operations.

Akira posted CLX Logistics to its data leak site on September 25th, claiming to have stolen 26GB of client, personal, and business documents. The Akira ransomware gang, first identified in May 2023, utilizes the Windows Restart Manager API to effectively close processes or terminate Windows services that might be actively using a file, thereby allowing the encryption process to proceed unhindered. In each computer folder affected by the ransomware, a ransom note named "akira_readme.txt" is placed. This note serves as a communication from the attackers, explaining the situation and providing links to the Akira data leak site and negotiation site.

The Threat and Its Implications

The ransom note issued by the Akira group contains a chilling warning: "Regarding your data, in the event that we fail to reach an agreement, we will attempt to sell your personal information, trade secrets, databases, source codes, and anything else deemed valuable on the dark market to multiple threat actors simultaneously. Subsequently, all of this compromised information will be publicly exposed on our blog." Like to other ransomware groups, the Akira gang infiltrates corporate networks and expands its reach to other connected devices. After acquiring Windows domain admin credentials, the threat actors deploy their ransomware across the entire network. Before encrypting the files, the attackers take the additional step of exfiltrating sensitive corporate data. This stolen information is then used as leverage during their extortion tactics, as they warn victims that the data will be made public unless a ransom payment is made.

The Akira gang has invested considerable effort into designing their data leak website, which features a retro aesthetic and allows visitors to navigate through it using command inputs.

Disclaimer

The Halcyon Attacks Lookout Database is compiled using publicly available information based on the hosting choices of real-world threat actors and data from a variety of trackers. This information is provided in accordance with principles of fair use. Halcyon has made reasonable efforts to sanitize and verify the data; however, we do not guarantee the accuracy, completeness, or reliability of the information provided. Updates to the database are made as new source data becomes available from reputable sources.  By accessing, viewing, or using the information within the Halcyon Attacks Lookout Database, you acknowledge and agree to do so entirely at your own risk. No reliance should be placed upon the information for decision-making, and Halcyon disclaims all liability for any inaccuracies or omissions in the data.

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.