Cactus Ransomware Gang Suspected to be Behind Schneider Electric Attack

Schneider Electric, the French multinational energy management and automation giant, suffered a ransomware attack that occurred on January 17th, 2024, affecting the company’s Sustainability Business division. The company confirmed in a recent statement that the incident disrupted division specific tools along with their Resource Advisory product, a data visualization tool for sustainability information which was reported to still be suffering from outages earlier this week. Schneider Electric serves organizations across one hundred (100) countries, as well as roughly 30% of all Fortune 500 companies, as reported in 2021, meaning impacts could vary greatly depending on what data the threat actors were able to obtain. The threat actor was not explicitly mentioned in statements made by Schneider Electric, but sources familiar with the situation report that the Cactus ransomware gang is behind the attack that led to the unauthorized access and theft of corporate data. Researchers warned about the Cactus ransomware group using online advertainments to infect victims back in December 2023, and an increase in activity from the group, seeing traces of their ransomware being used in attacks targeting the industrial and engineering industries, impacting their manufacturing and industrial control system (ICS) equipment. The Cactus ransomware operation first appeared in March 2023, the group being hailed as experienced and skilled hackers who are known to partake in double-extortion tactics, demanding ransom payments in order to receive a file decryptor and prevent stolen data from being leaked. The threat actors apparently have terabytes of data but there has been no mention as to the actual scope of data affected nor the nature of such data. The multinational company has been testing the operational capability of the impacted systems and seem optimistic that access will resume shortly.