Cyber Incident Victim: KFI Engineers
Date:
Feb 2023
Location:
United States of America
Summary
A Minnesota engineering firm serving schools and hospitals paid $300,000 to the Black Basta ransomware group after negotiations halved the initial ransom demand. The attackers claimed to have exfiltrated 1.1 TB of sensitive data, though the firm’s client-focused work likely limited exposure of highly sensitive information. Blockchain analysis revealed significant cryptocurrency transactions linked to the group, with one wallet processing over $34 million within a month, underscoring ransomware’s profitability. This incident may represent the victim’s second ransomware attack in approximately a year, following an unconfirmed BlackBytes intrusion, though details regarding the earlier event remain unclear.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early February 2023, KFI Engineers, a Minnesota-based engineering firm, experienced a ransomware attack by the Black Basta group. The attackers encrypted company systems and claimed to have exfiltrated 1.1 terabytes of data, which they vaguely classified as "sensitive." Black Basta initially demanded $600,000 to provide decryption tools and prevent data exposure but later reduced this demand to $300,000 during negotiations observed by cybersecurity researcher Marco A. De Felice. According to De Felice's reporting, KFI paid the $300,000 ransom on or around February 11, 2023. While KFI’s client list included schools and hospitals, the engineering firm was noted as unlikely to possess substantial volumes of personal health or educational records. The attackers did not specify what constituted the allegedly stolen "sensitive" data, leaving the precise scope and nature of the breach unclear.
De Felice’s monitoring of Bitcoin wallets associated with Black Basta revealed financial transactions linked to this incident alongside broader criminal activity. Analysis showed that the wallet receiving KFI’s payment also processed approximately $840,000 in additional transactions within three days, including deposits of $98,158 and $603,184 on February 14. Further investigation traced cumulative deposits totaling $34.1 million in Bitcoin between mid-January and mid-February 2023 across just two of the group’s wallets, suggesting extensive ransom payments from multiple victims. This financial tracking highlighted how ransom payments fund ongoing cybercriminal operations. Separately, unconfirmed reports indicated KFI might have suffered a prior cyberattack in December 2021 by a group called BlackBytes, though details about that incident’s resolution or any ransom payment remain undocumented. Black Basta’s ransom note threatened data disclosure, but as of February 21, 2023, no public confirmation existed regarding whether the group honored its post-payment deletion promises or leaked KFI’s data.