Rise of ransomware-as-a-service leading to blackmail-fueled industry

SCOTTSDALE, Ariz. — If you had trouble getting your morning coffee recently, you may have ransomware to blame for the disruption in service. 

Arizona-based supply chain management company Blue Yonder found itself under attack by ransomware that managed to disrupt its managed services hosted environment for the company. Blue Yonder has a global clientele of over 3,000 members and includes names like Coca-Cola and Starbucks, which uses the software to manage worker schedules. 

In a report by CNN, the incident was also found to have affected several major grocery chains in the UK, and per Blue Yonder, the company is still working on restoring its services at the time of this article. What it has not yet received is the bill. Ransomware-as-a-service (RaaS) is a cyber blackmail tactic on the rise that’s seen major industries extorted for money in order to restore services or keep information private, a tactic that has proved lucrative as companies scramble to pay ransoms.  

Earlier in November a new group on the scene called Hellcat demanded $125K in baguettes as a ransom payment from Schneider Electric, a global specialist in energy management. The group has also threatened to leak the data if they are not paid up. As unusual as it might seem, it’s business as usual according to Hüseyin Can Yuceel, security researcher at Picus Security. 

“Ransomware is a business model, and we can think of this bizarre baguette demand as a marketing stunt,” Yuceel said. “It should be noted that they also requested the ransom in Monero, not just baked goods.” 

He added, “Hellcat is a new ransomware group, and there is little to no information about them, as the oldest data in their leak site was published only days ago. I assume that Hellcat is trying to get attention and establish trust for future victims and associates for a possible RaaS operation. If they leak the stolen data, it would prove their capability. If Schneider pays up, it would prove their capabilities and trustworthiness to others.” 

A report by The Cyber Threat Intelligence Integration Center found that attacks in the past year have grown steady and consistent in line with previous years’ data, with over 2,300 incidents recorded by June 2024.