Shipping Company Transnet SOC Ltd.

In July 2021, Transnet SOC Ltd., a South Africa-based state-owned logistics company, fell victim to a **ransomware cyber-attack** executed by the **Blackmatter ransomware group** using **Death Kitty ransomware**. The attack crippled critical systems, including the **NAVIS System**, rendering computer operations unusable. The consequences were severe: **port operations halted entirely**, preventing cargo movement, while the company’s **website went offline**. Employees were forced to revert to **manual paper-based processes**, causing significant operational disruptions. The attack was financially motivated, with the threat actors seeking ransom payments. The outage had cascading effects on South Africa’s supply chain, trade, and economy, given Transnet’s pivotal role in managing the country’s ports, rail, and pipelines. The incident underscored the vulnerability of critical infrastructure to cyber threats and the potential for ransomware to paralyze large-scale industrial operations.

Source: https://securityaffairs.co/wordpress/120596/cyber-crime/transnet-soc-cyber-attack.html

TPRM report: https://www.rankiteo.com/company/transnet-soc-ltd

"id": "tra603092125",
"linkid": "transnet-soc-ltd",
"type": "Ransomware",
"date": "7/2021",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Transportation/Logistics',
                        'location': 'South Africa',
                        'name': 'Transnet SOC Ltd.',
                        'type': 'State-Owned Company'}],
 'data_breach': {'data_encryption': True, 'data_exfiltration': True},
 'date_detected': '2021-07',
 'description': 'In July 2021, South Africa-based Transnet SOC Ltd. '
                'experienced a ransomware cyber-attack on their computer and '
                'NAVIS systems. The Blackmatter ransomware group used Death '
                'Kitty ransomware to attack the system and gain information. '
                'The attack resulted in computer systems being unusable, '
                'halted port operations, no movement of cargo, the website '
                'being down, and staff having to switch to manual '
                'paper-and-pen work.',
 'impact': {'data_compromised': True,
            'downtime': True,
            'operational_impact': ['halted port operations',
                                   'no cargo movement',
                                   'manual paper-and-pen work'],
            'systems_affected': ['computer systems',
                                 'NAVIS system',
                                 'website']},
 'motivation': 'financial gain',
 'ransomware': {'data_encryption': True,
                'data_exfiltration': True,
                'ransomware_strain': ['Death Kitty', 'Blackmatter']},
 'threat_actor': 'Blackmatter',
 'title': 'Ransomware Attack on Transnet SOC Ltd.',
 'type': 'ransomware'}