Fonderia Boccacci

Fonderia Boccacci is an Italian company whose name translates to 'foundry,' indicating its involvement in metal casting and related manufacturing processes. The organisation is headquartered in Italy, though the specific city is not disclosed in the available sources. As a foundry, it likely produces metal components for various industrial applications, serving markets that require cast parts such as automotive, machinery, or construction sectors. The alias itself provides the primary insight into the company's core business activity.

On November 15, 2022, Fonderia Boccacci experienced a ransomware attack carried out by the MedusaLocker gang. This incident marked the first known compromise of an Italian organisation by MedusaLocker. The attackers gained initial access through a combination of vulnerable Remote Desktop Protocol configurations, phishing emails, and the execution of PowerShell scripts. Once inside the network, they deployed ransomware that encrypted critical data files across the company's systems. Concurrently, the gang exfiltrated a selection of company files and subsequently published samples of the stolen data on a leak site. The publication of these samples was intended to increase pressure on the victim to comply with the extortion demand. MedusaLocker demanded a ransom of approximately ten thousand United States dollars, payable in cryptocurrency, in exchange for the decryption key. The threat accompanying the demand warned that failure to pay would result in the full release of the exfiltrated dataset. While public sources do not disclose whether the ransom was paid or the extent of operational disruption, the incident is recorded as a notable case in the threat landscape targeting Italian manufacturing entities. The event illustrates how ransomware groups adapt their techniques to target specific regional industries.