Ransomware Attack on Bluebonnet Nutrition Corporation

Incident Date: May 18, 2024

Attack Overview
VICTIM
Bluebonnet Nutrition Corporation
INDUSTRY
Manufacturing
LOCATION
USA
ATTACKER
Bianlian
FIRST REPORTED
May 18, 2024

Ransomware Attack on Bluebonnet Nutrition Corporation

Victim Overview

Bluebonnet Nutrition Corporation, a leading manufacturer of premium dietary supplements, fell victim to a cyberattack by the ransomware group BianLian. The company, founded in 1991 and based in Sugar Land, Texas, specializes in creating high-quality nutritional supplements and natural health products. Bluebonnet Nutrition stands out in the industry for its commitment to using sustainable, USDA Organic, and non-GMO ingredients in its products, as well as its award-winning supplement line.

Company Profile

The company has an annual revenue of $27.9 million and employs approximately 62 people. The company recently expanded its operations with a new $18 million, 128,000-square-foot facility in the Sugar Land Business Park, allowing it to triple its workforce to about 300 employees.

Attack Details

The cyberattack on Bluebonnet Nutrition involved the use of ransomware by a group from the USA specializing in cybercrime. The attackers took possession of 2.6 terabytes of data, including sensitive information such as product incidents and complaints, financial data, contract information, files from the CFO's computer, operational documents, and email archives. The specific ransom demand remains undisclosed.

Ransomware Group BianLian

BianLian is a sophisticated ransomware group known for targeting businesses, governmental organizations, healthcare facilities, and educational institutions globally. The group has evolved from a banking trojan to advanced ransomware operations, emphasizing extortion-based strategies. BianLian distinguishes itself by using custom backdoors, PowerShell, and Windows Command Shell for defense evasion, as well as exfiltration-based extortion tactics.

Penetration of Company Systems

The ransomware group likely gained access to Bluebonnet Nutrition's systems through compromised Remote Desktop Protocol (RDP) credentials. The group implanted custom backdoors specific to the victim, allowing them to move laterally, collect data, and exfiltrate sensitive information. Bluebonnet Nutrition's vulnerabilities may have included inadequate endpoint detection and response solutions, making them susceptible to the ransomware attack.

<

Sources:

Disclaimer

The Halcyon Attacks Lookout Database is compiled using publicly available information based on the hosting choices of real-world threat actors and data from a variety of trackers. This information is provided in accordance with principles of fair use. Halcyon has made reasonable efforts to sanitize and verify the data; however, we do not guarantee the accuracy, completeness, or reliability of the information provided. Updates to the database are made as new source data becomes available from reputable sources.  By accessing, viewing, or using the information within the Halcyon Attacks Lookout Database, you acknowledge and agree to do so entirely at your own risk. No reliance should be placed upon the information for decision-making, and Halcyon disclaims all liability for any inaccuracies or omissions in the data.

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.