Target Sector: Manufacturing, Aerospace & Transportation
Court filings, technical advisories, and SEC Form 8-K enforcement disclosures documenting cyber intrusions against organizations in Manufacturing, Aerospace & Transportation.
Key Facts
- 16 documented prosecution and advisory matters targeting Manufacturing, Aerospace & Transportation.
- Cumulative reported financial losses exceed $17.6 billion.
- 2 of 16 cases reached conviction, guilty plea, or final sentencing.
- Tracked actors include Sandworm Team, LockBit Ransomware Group, Volt Typhoon, PLA Unit 61398.
Documented Incidents (16)
U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)
Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
Volt Typhoon Critical Infrastructure Pre-Positioning
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
U.S. v. Sun Kailiang et al. (PLA Unit 61398 / APT1)
Historic first-ever criminal indictment against state military actors: five Chinese military officers in People's Liberation Army Unit 61398 charged with cyber espionage against Westinghouse, U.S. Steel, Alcoa, and the United Steelworkers union.
U.S. v. Egor Igorevich Kriuchkov (Tesla Insider Threat Attempt)
Russian national who traveled to Nevada and offered a $1 million Bitcoin bribe to an employee at the Tesla Gigafactory in Sparks, Nevada, to introduce malware onto the company's internal network.
U.S. v. Daniel Rhyne (Industrial Insider Extortion)
Core infrastructure systems engineer who staged an extortion scheme against his own industrial employer, locking coworkers out of Active Directory domain controllers, changing administrator passwords, and demanding $750,000 in cryptocurrency.
U.S. v. Aleksandr Sikerin & Yevgeniy Polyanin (REvil Operations)
International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.
Operation Olympic Games (Stuxnet Industrial SCADA Cyberweapon)
Joint United States and Israeli covert cyber operation that deployed the Stuxnet computer worm, the first known malware capable of causing physical destruction to industrial hardware. The worm exploited four Windows zero-day vulnerabilities and compromised Siemens Step7 PLC software to spin Natanz nuclear centrifuges out of control.
CDK Global BlackSuit Ransomware Incident
Destructive ransomware incident that incapacitated CDK Global, the premier SaaS dealer management platform for approximately 15,000 car dealerships across North America. Attackers deployed BlackSuit ransomware throughout CDK cloud and on-premises data centers, forcing dealership employees into pen-and-paper workarounds for weeks until an estimated $25 million ransom was transferred.
WannaCry Global Self-Propagating Ransomware Worm
Global automated ransomware worm that weaponized the leaked NSA EternalBlue exploit (MS17-010) to self-propagate across 200,000 Windows computers in over 150 countries within hours, paralyzing 80 National Health Service (NHS) hospital trusts in the UK.
Boeing Commercial Airplanes Parts Supply Extortion
LockBit ransomware affiliates exploited the Citrix Bleed zero-day (CVE-2023-4966) to bypass multi-factor authentication, exfiltrating 43 gigabytes of sensitive internal aerospace data and parts distribution documentation from Boeing parts and distribution business.
U.S. v. Joseph Sullivan (Uber Breach Extortion Cover-up)
Historic federal criminal prosecution of former Uber Chief Security Officer Joseph Sullivan for obstruction of justice and misprision of a felony after concealing a massive breach of 57 million user and driver records by paying $100,000 in Bitcoin through a bug bounty program under non-disclosure agreements.
Salt Typhoon U.S. Telecommunications Wiretap Infrastructure Infiltration
Chinese state-sponsored espionage campaign (Salt Typhoon / GhostEmperor / FamousSparrow) compromising core routing and lawful intercept infrastructure of major U.S. broadband and wireless carriers (including AT&T, Verizon, and Lumen), gaining persistent access to CALEA court-ordered wiretap requests and unencrypted call metadata of senior government officials.
TRITON / HatMan Petrochemical Safety Instrumented System Attack
Russian state research institute (Central Scientific Research Institute of Chemistry and Mechanics / TsNIIKhM) deployed the TRITON (HatMan) malware framework inside a Saudi Arabian petrochemical plant, directly manipulating Schneider Electric Triconex Safety Instrumented System (SIS) controllers to cause emergency plant shutdowns with the potential for physical explosion.
United States ex rel. Markus v. Aerojet Rocketdyne (Civil Cyber-Fraud Settlement)
Landmark Department of Justice Civil Cyber-Fraud Initiative settlement under the False Claims Act where defense contractor Aerojet Rocketdyne paid $9 million to resolve a qui tam whistleblower lawsuit alleging it falsely certified compliance with federal cybersecurity regulations (DFARS 252.204-7012 and NIST SP 800-171) on Department of Defense and NASA missile contracts.
U.S. v. Amin Stigal (GRU Unit 29155 WhisperGate Wiper)
Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.