Loading story…
Jewett-Cameron Trading Company, a leading manufacturer and distributor of fencing, pet, and industrial wood products, experienced a significant cybersecurity incident involving a ransomware attack. On October 15, 2025, the company detected unauthorized access to its IT environment, which was later disclosed in an SEC 8-K filing. The attackers deployed encryption and monitoring software on portions of the company’s internal corporate systems, disrupting business applications and limiting access to certain operational and corporate functions. As a precaution, Jewett-Cameron voluntarily took some systems offline to contain the incident. The ransomware gang exfiltrated sensitive data, including images of video meetings, computer screens, and non-public financial documents, some of which were being prepared for the company’s annual SEC report. The threat actors threatened to publicly release the stolen information unless a ransom was paid, increasing the pressure on the company. The company’s 8-K filing confirmed that law enforcement was notified and external cybersecurity experts were engaged to assist with the investigation and recovery efforts. The breach’s full impact on records and data types remains under investigation, but it is confirmed that sensitive company information was accessed and exfiltrated. The company’s operations were disrupted, though the incident was reported as contained at the time of disclosure. Jewett-Cameron’s response included activating its cyber incident response process, assessing the scope of the breach, and implementing remedial measures to secure its systems. The company did not disclose whether any ransom was paid or if any data had been released by the attackers. The incident occurred during a critical period as the company was preparing its annual financial filings, potentially increasing the risk of exposure of sensitive financial data. The company’s public communications emphasized its commitment to transparency and regulatory compliance by promptly filing the required SEC disclosure. The attack highlights the ongoing threat of ransomware to manufacturing and distribution companies, particularly those handling sensitive financial and operational data. The use of monitoring software by the attackers suggests a period of surveillance prior to data exfiltration and encryption, indicating a sophisticated approach. The company’s swift engagement with law enforcement and cybersecurity professionals reflects best practices in incident response. The long-term impact on Jewett-Cameron’s business operations, reputation, and regulatory standing remains to be fully assessed as the investigation continues. The incident underscores the importance of robust cybersecurity measures and incident response planning for organizations in the manufacturing and distribution sectors.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
By October 23, 2025, coverage described the incident as a ransomware attack that disrupted Jewett-Cameron's operations. This represented a clearer public characterization of the attack's operational impact.
Reporting on October 22, 2025 said a ransomware group had stolen sensitive data from Jewett-Cameron, including meeting videos and financial information tied to the fence wholesaler. This added public details about the nature of the data allegedly taken.
Jewett-Cameron Trading Company disclosed a cybersecurity incident affecting its environment in a filing reflected by incident trackers on October 21, 2025. The disclosure marked the first public acknowledgment of the incident.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourceboard-cybersecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
West Pharmaceutical Services disclosed a material cybersecurity incident after detecting suspicious activity on May 4 and determining by May 7 that an unauthorized actor had exfiltrated data and encrypted multiple internal systems. In an SEC filing, the pharmaceutical packaging and drug-delivery manufacturer said the attack disrupted parts of its global operations, including manufacturing, shipping, and enterprise functions. The company isolated affected systems, restricted enterprise network access, notified law enforcement, and brought in external incident-response support from **Palo Alto Networks Unit 42** while recovery efforts continued. West said some production and distribution systems have been restored and manufacturing has partially resumed, but the investigation is ongoing and the full scope of stolen data and financial impact remains unknown. No ransomware group has publicly claimed responsibility, though the combination of data theft and encryption matches **double-extortion ransomware** tactics that have repeatedly hit pharmaceutical manufacturers and broader healthcare supply chains, including earlier warnings from Indian drugmaker Sun Pharma that a ransomware attack could lead to revenue loss and litigation.
Jun 29, 2026
**Advantest Corporation** reported a cybersecurity incident in which an unauthorized party appears to have accessed parts of its network and **deployed ransomware**, impacting certain internal systems. The company said it detected unusual activity on **Feb. 15 (JST)**, activated incident response procedures, **isolated affected systems**, and engaged third-party cybersecurity specialists to support investigation and containment; the investigation remains ongoing and findings may change as more facts are confirmed. Public reporting echoed Advantest’s statement that the scope and responsible ransomware group are **not yet identified**, and noted the broader trend of increased ransomware targeting of industrial and manufacturing organizations, including the semiconductor sector. Advantest stated it will provide updates and, if the investigation determines **customer or employee data** was affected, it will notify impacted individuals directly with guidance on protective measures.
Jun 29, 2026
A major global equipment manufacturer suffered a severe ransomware attack orchestrated by the BlackSuit ransomware group, also known as Ignoble Scorpius. The attack began with a vishing (voice phishing) campaign in which an attacker impersonated the company's IT help desk and convinced an employee to enter their VPN credentials into a phishing site. Using these stolen credentials, the attackers gained initial access to the corporate network. Once inside, they escalated privileges by executing a DCSync attack on a domain controller, allowing them to steal highly privileged credentials, including those of a key service account. The attackers then moved laterally across the network using Remote Desktop Protocol (RDP), Server Message Block (SMB), and tools such as Advanced IP Scanner and SMBExec to map the environment and identify valuable assets. Persistence was established by deploying AnyDesk and a custom remote access trojan (RAT) as scheduled tasks on domain controllers. The threat actors compromised a second domain controller and extracted the NTDS.dit database, which contains all user password hashes, enabling further credential compromise. Over 400 GB of sensitive data was exfiltrated using a renamed rclone utility. To erase forensic evidence and hinder incident response, the attackers deployed CCleaner before launching the ransomware payload. The BlackSuit ransomware was deployed using Ansible, resulting in the simultaneous encryption of hundreds of virtual machines across nearly 60 VMware ESXi hosts, causing widespread operational disruption. The attackers demanded a $20 million ransom, which the organization refused to pay. In response, the manufacturer implemented several security measures, including upgrading to newer Cisco Adaptive Security Appliance firewalls, enforcing multi-factor authentication, segmenting the network, deactivating NTLM, and restricting administrative access to isolated VLANs. The incident highlights the significant risks posed by social engineering and credential theft, as well as the sophisticated tactics used by modern ransomware groups. The attack demonstrates the importance of robust incident response, credential hygiene, and layered security controls to mitigate the impact of such breaches. The use of legitimate remote access tools and living-off-the-land techniques by the attackers complicated detection and response efforts. The exfiltration of large volumes of sensitive data prior to encryption underscores the dual extortion tactics now common among ransomware operators. The manufacturer’s refusal to pay the ransom and rapid implementation of enhanced security controls serve as a case study in post-incident resilience. The attack also illustrates the growing trend of targeting virtualization infrastructure, such as VMware ESXi hosts, to maximize operational disruption. Security researchers and incident responders continue to analyze the tactics, techniques, and procedures (TTPs) used in this attack to inform defensive strategies for other organizations.
Jun 29, 2026