Dark Angels Team ransomware group hit Johnson Controls

Johnson Controls International suffered a ransomware attack that impacted the operations of the company and its subsidiaries.

Johnson Controls International plc is a multinational conglomerate with a diversified portfolio of products and services primarily focused on building technologies and solutions. The company provides HVAC (heating, ventilation, and air conditioning), solutions for building automation, fire and security systems, and components for energy management.

Johnson Controls International announced it has suffered a ransomware attack that impacted many systems of the company, Bleeping Computer reported.

“The threat actors also claim to have stolen over 27 TB of corporate data and encrypted the company’s VMWare ESXi virtual machines during the attack.” reported Bleeping Computer.

The attack took place over the weekend and threat actors initially breached the systems at Asia offices, the ransomware also targeted the VMware ESXi servers.

The security breach forced the company to shut down its systems to prevent the threat from spreading

“Johnson Controls International plc (the “Company”) has experienced disruptions in portions of its internal information technology infrastructure and applications resulting from a cybersecurity incident.”  reads the 8-K form filed with SEC. “To date, many of the Company’s applications are largely unaffected and remain operational. To the extent possible, and in line with its business continuity plans, the Company implemented workarounds for certain operations to mitigate disruptions and continue servicing its customers. However, the incident has caused, and is expected to continue to cause, disruption to parts of the Company’s business operations.”

Immediately after detecting the intrusion, the company launched an investigation with the help of leading third-party cybersecurity experts and is also coordinating with its insurers. The investigation is still ongoing and aims at determining the scope of the incident. The Company is assessing whether the security breach will impact its ability to timely release its fourth quarter and full fiscal year results, as well as the impact on its financial results.

Security researcher Gameel Ali speculated that Johnson Controls was the victim of the Dark Angels Team extortion group that has developed a new variant of their Linux ransomware.

According to BleepingComputer, the ransomware group is demanding $51 million to provide a decryptor, the amount of the ransom was confirmed by Malware Hunter Team researchers:

The researchers believe that the ransomware used in the attack is basically still the same RagnarLocker Linux ransomware developed in 2021.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Johnson Controls International)