{
	"id": "50f0c9bf-39f1-453f-9460-d38f6de534de",
	"created_at": "2026-04-06T00:13:12.838829Z",
	"updated_at": "2026-04-10T03:26:47.04411Z",
	"deleted_at": null,
	"sha1_hash": "cfefffb2cbe78de9fa24fa1637f675f28b6f83bb",
	"title": "Ransomware hits helicopter maker Kopter",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 747197,
	"plain_text": "Ransomware hits helicopter maker Kopter\r\nBy Written by Catalin Cimpanu, ContributorContributor Dec. 4, 2020 at 11:15 p.m. PT\r\nArchived: 2026-04-05 14:31:27 UTC\r\nImage: Kopter\r\nHelicopter maker Kopter has fallen victim to a ransomware attack after hackers breached its internal network and\r\nencrypted the company's files.\r\nAfter Kopter refused to engage with the hackers, the ransomware gang has published on Friday some of the\r\ncompany's files on the internet.\r\nSEE: Meet the hackers who earn millions for saving the web, one bug at a time (cover story PDF)\r\n(TechRepublic)\r\nMany ransomware groups upload and share victim data on special \"leak sites\" as part of their tactics to put\r\npressure on the hacked companies to either have them come to the negotiation table or force them into paying\r\nhuge ransom demands.\r\nLockBit ransomware gang takes credit\r\nThe Kopter data has been published on a blog hosted on the dark web and operated by the LockBit ransomware\r\ngang. Files shared on this site include business documents, internal projects, and various aerospace and defense\r\nindustry standards.\r\nkopter-ransom-page.png\r\nImage: ZDNet\r\nkopter-sample-files.png\r\nhttps://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/\r\nPage 1 of 2\n\nImage: ZDNet\r\nIn an email, the operators of the LockBit ransomware told ZDNet that they breached Kopter's network last week\r\nby exploiting a VPN appliance that used a weak password and did not have two-factor authentication (2FA)\r\nenabled.\r\nThe LockBit gang also said they operate a web portal on the dark web where they show details to hacked\r\ncompanies about the attack, including a ransom demand. LockBit operators said someone from Kopter accessed\r\nthe ransom page, but the company did not engage with them in a chat window provided to hacked companies.\r\nKopter has not publicly disclosed a security breach on its website or via business wires.\r\nA Kopter spokesperson did not return an email seeking comment on the ransomware attack. Phone calls made on\r\nFriday also remained unanswered.\r\nThe Switzerland-based company was founded in 2007 and is known for its line of small and medium-class civilian\r\nhelicopters.\r\nIn January 2020, Italian aerospace and defense company Leonardo acquired Kopter for an undisclosed sum.\r\nThe most dangerous iOS, Android malware and smartphone vulnerabilities of 2019\r\nSecurity\r\nEditorial standards\r\nSource: https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/\r\nhttps://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/"
	],
	"report_names": [
		"ransomware-hits-helicopter-maker-kopter"
	],
	"threat_actors": [
		{
			"id": "0fc739cf-0b82-48bf-9f7d-398a200b59b5",
			"created_at": "2022-10-25T16:07:23.797925Z",
			"updated_at": "2026-04-10T02:00:04.752608Z",
			"deleted_at": null,
			"main_name": "LockBit Gang",
			"aliases": [
				"Bitwise Spider",
				"Operation Cronos"
			],
			"source_name": "ETDA:LockBit Gang",
			"tools": [
				"3AM",
				"ABCD Ransomware",
				"CrackMapExec",
				"EmPyre",
				"EmpireProject",
				"LockBit",
				"LockBit Black",
				"Mimikatz",
				"PowerShell Empire",
				"PsExec",
				"Syrphid"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434392,
	"ts_updated_at": 1775791607,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/cfefffb2cbe78de9fa24fa1637f675f28b6f83bb.pdf",
		"text": "https://archive.orkl.eu/cfefffb2cbe78de9fa24fa1637f675f28b6f83bb.txt",
		"img": "https://archive.orkl.eu/cfefffb2cbe78de9fa24fa1637f675f28b6f83bb.jpg"
	}
}