Key Learnings from the Tempur Sealy Ransomware Attack

For members of the notorious ALPHV, also known as BlackCat, ransomware group, it’s been some great few months. For the security and business leaders at Tempur Sealy, one of the largest mattress and bedding manufacturers in the world, not so much.

On July 23, 2023, the CEO of Tempur Sealy reported that a cyberattack had shuttered the company’s business operations after ALPHV infiltrated the company’s IT environment. The news about Tempur Sealy follows on the heels of the cyberattack targeting Estée Lauder Companies, the second-largest cosmetics company globally.

In both cases, the ALPHV ransomware group claimed responsibility in a post on a Dark Web message forum and even shared a sampling of sensitive documents they exfiltrated, such as customers’ banking information, shipping addresses, order details, and even coupon usage. In the case of Tempur Sealy, the reason behind sharing the sample documents was a brazen move to force the company to publicly disclose the cyberattack.

Of course, the impact on Tempur Sealy was undoubtedly significant:

• Data Breach: The breach resulted unauthorized access to sensitive data, including the General Counsel’s computer, leading to severe legal and financial ramifications.
• Reputation Damage: A loss of trust from customers and partners due to compromised data protection can result in a substantial loss of business.
• Financial Loss: Responding to a cyberattack can entail significant costs, including ransom payments, investigation expenses, security enhancements, and potential legal fees and fines.
• Legal and Regulatory Consequences: Failure to adequately protect sensitive data or report breaches promptly can result in legal and regulatory repercussions.
• Operational Disruption: Disabling systems to contain or investigate an attack can result in lost productivity and revenue.

Who is the ALPHV / BlackCat Ransomware Group?

The ALPHV/BlackCat ransomware is developed and operated as a ransomware-as-a-service (RaaS) by a group known as Alpha Spider. Additionally, based on further research from our Threat Response Unit (TRU), the top targeted sectors observed have been legal, business services, software, finance, healthcare, and manufacturing.

In many cases, ALPHV uses triple extortion to force its targets to do its bidding and pay the ransom; if the victims don’t take action, the group threatens to leak the exfiltrated data to the public and even disrupt operations further by conducting Distributed Denial of Service (DDoS) attacks.

The Canadian Centre for Cyber Security also issued an Alert with details on the tactics, techniques, and procedures (TTPs) used by ALPHV to deploy ransomware:

• To gain initial access, it’s likely that ALPHV uses social engineering tactics (e.g., phishing or drive-by attacks) to steal and harvest user credentials.
• The threat actors can then use privilege escalation to steal credentials for users with admin-level access.
• Next, the threat actors may maintain persistence or scan for remote desktop protocol (RDP) and SMB enabled devices by using various remote monitoring and management tools, and a variety of other techniques (e.g., domain policy modification, account manipulation, etc.).
• Operators behind BlackCat may also move laterally within the network by using software deployment tools or using RDP connections to steal more credentials.
• Once the systems have been encrypted, ALPHV may be deleting virtual machine or Windows shadow copy backups.

What Can You Learn from the Tempur Sealy Ransomware Attack?

While it’s unclear exactly how ALPHV managed to gain initial access into Tempur Sealy’s internal environment, it’s likely that some form of social engineering was at play here, underscoring the importance of regularly conducting managed phishing and security awareness training with your employees – even your executive leadership team.

A more important factor to consider is what kind of endpoint protection platform you have set in place, especially if your organization still uses an on-premises or hybrid environment for data storage. What’s more, you need an endpoint detection and response (EDR) solution that can protect your assets no matter where your users or data reside – in the cloud, mobile, virtual, or physical environments.

This also means you need to pay closer attention to your EDR solution provider and evaluate the tools and technologies they’re using to protect your assets. In their Dark Web forum message, ALPHV went so far as to single out Tempur Sealy’s incident response and MDR provider, Arctic Wolf, and even singled out that Arctic Wolf’s endpoint agent is a “rebranded OSSEC” (i.e., an open-source host-based intrusion detection system).

Unfortunately, OSSEC itself comes with its own set of challenges:

• Lack of Best-of-Breed Proprietary IP: Given that out-of-the-box OSSEC solutions don’t incorporate proprietary intellectual property and rely on existing open-source technologies available to the public, you’re potentially adopting a tool with limited uniqueness and effectiveness.
• DFIR Capabilities: Since the OSSEC platform isn’t designed for digital forensics and incident response (DFIR) functions, it could hinder your ability to effectively investigate and respond to security incidents.
• Limited Prevention Capabilities: If your MDR provider doesn’t demonstrate complete proactive response capabilities, it’s likely they may only be able to detect and respond to an attack after it occurs – at which point, it may already be too late. Your MDR or EDR provider should be able to proactively prevent an attack from occurring with custom detection engineering based on threat intel and proactive threat sweeps, novel detection rules, and proprietary machine learning models that hunt and respond to endpoint threats.

Notes from eSentire’s Threat Response Unit (TRU):

• Our 24/7 SOC Cyber Analysts, in addition to TRU, have implemented detections for the ALPHV/BlackCat ransomware. More importantly, we also have capabilities to detect and contain some of the more common attack vectors and precursor malware associated with this threat actor group.
• TRU has observed and stopped 100+ attacks across our global customer base involving malware that is a precursor to ALPHV/BlackCat ransomware; about 35% of these have been in 2023.

Recommendations to Prevent and Mitigate Ransomware Attacks

Preventing the various attack technique and tactics utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detections, and the ability to investigate logs & network data during active intrusions. 

We recommend implementing the following controls to help secure your organization against BlackCat ransomware attacks: 

• Use a robust Endpoint Detection and Response (EDR) solution that doesn’t rely on open-source software components and confirm that all your endpoint devices are protected with the EDR solution.
  • Ensure that your security team has full visibility into your IT environment using EDR agents and centralized logging on domain controllers since they are a key target for ransomware actors.
• Implement a Phishing and Security Awareness Training (PSAT) program that educates and informs your employees on emerging threats in the threat landscape.
• Encourage your employees to use password managers instead of using the password storage feature provided by web browsers. Use master passwords where it’s applicable.
• Use the principle of least privilege so only the users that need access to certain data have access to it.
  • Establish protocols so that if an employee requires access to data that they don’t normally need to complete a specific task, that access is taken away after a certain period of time or it expires as soon as the task is complete.
• Engage a 24/7 Managed Detection and Response (MDR) provider who combines XDR technology, multi-signal threat intelligence, and Elite Threat Hunters for 24/7 threat detection, investigation, and response capabilities.
• Work with your Incident Response (IR) provider to build an IR plan that’s right for your organization so that if a cyberattack does occur, your team is ready with remediation and response efforts.

There is no guarantee that your organization will never be targeted by a ransomware attack. This is why it’s important to have the right security provider by your side – one with a team of 24/7 SOC Cyber Analysts and Elite Threat Hunters – who can help you anticipate, withstand, and recover from the toughest cyberattacks.

To learn how eSentire MDR can help you build a more resilient security operation, connect with an eSentire cybersecurity specialist.