Sanko Air Plant: ransomware; attackers abused a guest account over VPN

On 24 October 2024 the pneumatic conveying systems maker Sanko Air Plant (Chuo, Osaka) disclosed a system outage caused by a cyberattack. Its December findings said that at 15:51 on 21 October an intruder abused a guest account over a VPN connection to enter its network, and from that night ran a ransomware attack on its servers. Data on some servers and PCs was encrypted and a ransom note was left. The access came from abroad (Lithuania), and there had been earlier intrusions on 31 August and 13 September. No traces of data being sent out were found. The company said a VPN device vulnerability was considered one of the causes.