{"id":3214,"date":"2021-09-21T13:20:35","date_gmt":"2021-09-21T07:50:35","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=3214"},"modified":"2021-09-21T13:20:37","modified_gmt":"2021-09-21T07:50:37","slug":"blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/","title":{"rendered":"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M"},"content":{"rendered":"\n
U.S. farmers cooperative NEW Cooperative has gone through a BlackMatter ransomware attack asking for $5.9 million not to expose the hijacked data and facilitate a decryptor.<\/p>\n\n\n\n
NEW Cooperative is a farmer\u2019s feed and grain cooperative with over sixty locations throughout Iowa. In a weekend ransomware attack, the threat actor demands a 5.9 million dollar ransom, which will escalate to $11.8 million if a ransom is not paid in five days.<\/p>\n\n\n\n
These ransom demands are an initial point for compensation and usually lead to significantly smaller transactions if a victim decides to pay. NEW Cooperative has proved the attack to our experts and stated that they had taken their systems offline to contain the attack\u2019s spread.<\/p>\n\n\n\n
\u201cNEW Cooperative currently identified a cybersecurity incident that is affecting some of the organization\u2019s devices and systems. From all the abundance of caution, we have proactively taken our systems offline to contain the threat, and we can confirm it has been completely contained,\u201d a NEW Cooperative spokesperson told our experts. \u201cWe also immediately alert the law enforcement and are working closely with the data security experts to research and alleviate the current situation.\u201d<\/p>\n\n\n\n
How BlackMatter Targets Sensitive Infrastructure?<\/strong><\/h2>\n\n\n\n
Investigators first learned of the attack after a ransomware sample was initially uploaded to a public malware analysis site in recent days. This sample permitted access to the BlackMatter ransom note, the ransomware compensation page, and a non-public data exposure page containing screenshots of allegedly hijack data.<\/p>\n\n\n\n
BlackMatter is believed to be a rebrand of the DarkSide ransomware that disappeared after attacking the Colonial Pipeline. When BlackMatter first comes, they said that they would not target \u201cCritical infrastructure facilities (nuclear power plants, power plants, water treatment facilities).\u201d From the various screenshots of the compensation page shared on Twitter, NEW Cooperative asked BlackMatter why they were attacked as they are considered as the sensitive infrastructure and the attack will lead to food supply disruption for grain, pork, and chicken.<\/p>\n\n\n\n
New Cooperative also stated that they would have to contact the regulators and CISA about the attack. BlackMatter revert that they do not \u201cfall under the rules\u201d and threaten to double the ransom amount in case the NEW Cooperative didn\u2019t change its approach to the compensation.<\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
<\/figure><\/div>\n\n\n\n
\u201cWe are not threatening you. This is pretty much out of our hands. We can\u2019t even control what the handlers and the US government does,\u201d a NEW Cooperative representative told the attackers in the negotiation chats. <\/p>\n\n\n\n
“The affect of this attack will likely be much worse than the pipeline attack for context, and we have no way to control that given the disruption this has already caused.” “We are just telling you this so you are not surprised as it does not seem like you understood who we are and what role our company plays in the food supply chain.” BlackMatter responded with, “No one will give you decrypters for free, look for money.”<\/p>\n\n\n\n
If you have first-hand information about this or other unreported cyberattacks, you can confidentially contact us on Signal at +16469613731, Wire at @lawrenceabrams-bc, or on Jabber at lawrence.abrams@anonym.im. <\/p>\n\n\n\n
Attackers Claim to Hijack 1,000 GB of Data<\/strong><\/h2>\n\n\n\n
On the non-public data exposure page, the threat actors claim to have hijacked the source code for the soilmap.com project, R&D results, sensitive employee information, financial documents, and an exported database for the KeePass password manager.<\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
The pages consist up of screenshots of supposedly hijack data, including legal documents, a screenshot of an application, and financial information. Our Experts have decided not to disclose these images due to their potentially sensitive nature. <\/p>\n","protected":false},"excerpt":{"rendered":"
U.S. farmers cooperative NEW Cooperative has gone through a BlackMatter ransomware attack asking for $5.9 million not to expose the hijacked data and facilitate a decryptor. NEW Cooperative is a farmer\u2019s feed and grain cooperative with over sixty locations throughout Iowa. In a weekend ransomware attack, the threat actor demands a 5.9 million dollar ransom, […]<\/p>\n","protected":false},"author":2,"featured_media":3216,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"yoast_head":"\n
BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"U.S. farmers cooperative NEW Cooperative has gone through a BlackMatter ransomware attack asking for $5.9 million not to expose the hijacked data and facilitate a decryptor. NEW Cooperative is a farmer\u2019s feed and grain cooperative with over sixty locations throughout Iowa. In a weekend ransomware attack, the threat actor demands a 5.9 million dollar ransom, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-21T07:50:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-21T07:50:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/BlackMatter-Ransomware-Attack-Hit-US-Farmer-Cooperative-by-5.9M-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M\",\"datePublished\":\"2021-09-21T07:50:35+00:00\",\"dateModified\":\"2021-09-21T07:50:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/\"},\"wordCount\":615,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Breaches\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/\",\"url\":\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/\",\"name\":\"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-09-21T07:50:35+00:00\",\"dateModified\":\"2021-09-21T07:50:37+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/","og_locale":"en_US","og_type":"article","og_title":"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M - Xiarch Solutions Private Limited","og_description":"U.S. farmers cooperative NEW Cooperative has gone through a BlackMatter ransomware attack asking for $5.9 million not to expose the hijacked data and facilitate a decryptor. NEW Cooperative is a farmer\u2019s feed and grain cooperative with over sixty locations throughout Iowa. In a weekend ransomware attack, the threat actor demands a 5.9 million dollar ransom, […]","og_url":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-09-21T07:50:35+00:00","article_modified_time":"2021-09-21T07:50:37+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/BlackMatter-Ransomware-Attack-Hit-US-Farmer-Cooperative-by-5.9M-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M","datePublished":"2021-09-21T07:50:35+00:00","dateModified":"2021-09-21T07:50:37+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/"},"wordCount":615,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Breaches"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/","url":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/","name":"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-09-21T07:50:35+00:00","dateModified":"2021-09-21T07:50:37+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/blackmatter-ransomware-attack-hit-us-farmer-cooperative-by-5-9m\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"BlackMatter Ransomware Attack Hit US Farmer Cooperative by $5.9M"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3214"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=3214"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3214\/revisions"}],"predecessor-version":[{"id":3220,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3214\/revisions\/3220"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/3216"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=3214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=3214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=3214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"BlackMatter-Ransomware-Attack-Hit-US-Farmer-Cooperative-by-$5.9M](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/BlackMatter-Ransomware-Attack-Hit-US-Farmer-Cooperative-by-5.9M-image1.png\")
<\/figure><\/div>\n\n\n\n![\"BlackMatter-Ransomware-Attack-Hit-US-Farmer-Cooperative-by-$5.9M](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/BlackMatter-Ransomware-Attack-Hit-US-Farmer-Cooperative-by-5.9M-image2.png\")
<\/figure><\/div>\n\n\n\n![\"BlackMatter-Ransomware-Attack-Hit-US-Farmer-Cooperative-by-$5.9M](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/BlackMatter-Ransomware-Attack-Hit-US-Farmer-Cooperative-by-5.9M-image3-1024x442.jpg\")
<\/figure><\/div>\n\n\n\n