Maximum Industries

Summary

LockBit ransomware group breached Maximum Industries, a Texas-based manufacturing contractor, stealing approximately 3,000 SpaceX-engineered technical drawings which they threatened to auction. The attackers typically exploit vulnerabilities or use insider access to deploy ransomware after exfiltrating data. Associated with Russian operatives, LockBit is among the most prolific ransomware operations, targeting over 1,000 organizations globally, including major corporations. The incident highlights risks to supply chain partners of high-profile entities.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 14, 2023, the LockBit ransomware group publicly asserted it had compromised Maximum Industries, a Texas-based contract manufacturer specializing in waterjet cutting, laser cutting, and CNC machining services. The attackers claimed the company served SpaceX as a contractor and alleged they had exfiltrated approximately 3,000 engineering drawings certified by SpaceX engineers. LockBit announced its intent to sell these documents via an auction, implying the data held significant commercial or strategic value. Maximum Industries, as described in its public profile, produces piece parts, suggesting the compromised files could relate to manufacturing specifications or aerospace components. SecurityWeek documented attempts to contact both SpaceX and Maximum Industries for verification, but neither entity provided a response to the claims. The breach’s validity remained unconfirmed by independent sources at the time of reporting, with SecurityWeek noting that ransomware groups frequently exaggerate the value or impact of stolen data to pressure victims or attract buyers.

LockBit, operating since 2019 and suspected to be based in Russia, historically gained access to victim networks through exploits targeting unpatched vulnerabilities, collaboration with insider threats, or purchases of initial access from specialized cybercriminal groups. Following infiltration, the group typically exfiltrates sensitive data before deploying encryption malware to disrupt operations. At the time of the Maximum Industries incident, LockBit was considered the most active ransomware operation globally, having targeted over 1,000 organizations, including prominent entities like German automotive supplier Continental. The group’s claims against Maximum Industries emerged amid broader law enforcement actions against its affiliates, including the arrest of a Russian national in Canada linked to LockBit attacks, and disruptions such as DDoS attacks targeting LockBit’s leak site during the Entrust data leak incident. No public statements from Maximum Industries or SpaceX regarding breach containment, data recovery, or incident response were reported.

Sources

Sources available to members: 1 source.