Canadian Defense Contractor Top Aces Hit with LockBit Ransomware, Stealing 44GB Data

Canadian fighter jet training company, Top Aces confirmed on Wednesday (11 May) that it was attacked by LockBit, robbed 44GB data and threated to leak all of them online as a result of unpaid ransomware.

Threat analyst Brett Callow at Emsisoft, a security vendor, noted that cyber attacks on defense sector companies worried everyone involved, for no one knew where the robbed data may end up. Even if the ransomware group behind the attack works for profit, they might sell the data to a third party related to hostile governments, he added.

Cyber threats imperiled defense industrial base sector are on the rise, taking the examples of

Visser Precision, a parts manufacturer for Lockheed Martin, and Westech International, a U.S. government military services specializing in missile & space technology and mission support logistics.

The LockBit ransomware gang set Top Aces a deadline of May 15 before breached the stolen data. Now, two days goes by, whether Top Aces paid the ransomware remains unknown.

Top Aces, headquartered in Montreal, Canada, is a private company and provides advanced airborne training the Canadian and German armed forces. Founded in 2000 by former fighter pilots, it said to have the largest footprint of private fighter aircraft around the world and signed a contact with the US Air Force besides collaboration with Israel, Australia and other countries.

LockBit is one of the most active and lucrative ransomware groups, around 12,125 companies fall prey to it based on its screenshot exposed and brings in $ 1.2 billion. Report from Recorded Future suggests it has attacked at least 650 organizations in 2022. The latest victims are German library service EKZ Bibliotheksservice and Rio de Janeiro finance department.

Cyber attacks vary in types in tandem with the digitization of business and fall into DoS/DDoS attacks, phishing attacks, whale-phishing attacks, ransomware, URL interpretation, DNS spoofing, session hijacking and much more. There is no organization can fully protect itself from the ever-growing cyber threats. Measures, however, against cybercrimes need to be taken. Common methods aside, a dependable backup software with advanced recovery features and anti-ransomware detection is a must. Only in this way, can institutions hit by ransomware or other attacks have the second chance to back up and run. Vinchin Backup & Recovery is an experienced virtual machine protection solution combing overall data backup and advanced recovery features.

1.     Start with frequent backups

Vinchin Backup & Recovery has multiple intelligent backup strategies-full backup, CBT/SpeedKit driven incremental backup and differential backup-under the automatic scheduling and reasonable retention polices available. CBT/SpeedKit extracts only changed data for efficiency, while retention policies keep data in terms of backup points or days. The whole backup process is automated and requires no extra manual supervision.

2.     Proceed with anti-ransomware protection

Vinchin Backup & Recovery enables real-time I/O detector to prevent unauthorized programs modifying the data. Any unauthorized access will be denied in better protection of backups stored in the backup storage. The security has been reinforced further after the data encryption in this way.

3.     Prepare with advanced recovery

With offsite backup copies of the software, you are able to restore the backup data if the primary production system fails, and establishes a temporary DR center with those backups for minimum impact on the business. Instant recovery allows you to recover the VM and run on the production server within 15 seconds. Thus, you can rest assured that your backup data is highly recoverable in the event of ransomware attack.

Worldwide businesses, faced with widespread cybercrimes, have no choice but to dive into the comprehensive data security plans in case of accidents. Backup is never the plan A or plan B that lays the foundation for the grand protection strategy, instead it is the last line and saving grace for data loss. Back up now, then you can stage a comeback.