GkNur Gıda has been targeted by the Dreamfyre ransomware group, resulting in the unauthorized exfiltration of sensitive organizational data and the encryption of critical system assets. The attack likely involved an initial compromise via RDP exploitation or VPN vulnerabilities, followed by lateral movement using Cobalt Strike beacons and Mimikatz for privilege escalation. The threat actors employed double extortion tactics, leveraging tools such as Rclone and MegaSync to exfiltrate PII and financial records prior to deploying a payload utilizing AES-256 and RSA-2048 encryption. This incident underscores the persistent risk of emerging ransomware splinter groups targeting food production supply chains to maximize operational leverage.

• Incident Overview: Breach Timeline

  • Initial penetration occurred via common edge vectors, likely RDP exploitation or VPN vulnerabilities, to establish a foothold.
  • Phased progression from initial access to full administrative control through targeted privilege escalation.
  • Culmination in the deployment of the Dreamfyre ransomware payload, resulting in widespread encryption of critical assets.

• Attack Vector: Campaign Mechanics

  • Utilization of Cobalt Strike beacons for command-and-control (C2) communications and internal network reconnaissance.
  • Deployment of Mimikatz to harvest credentials from memory, facilitating rapid lateral movement across the environment.
  • Execution of data exfiltration using Rclone and MegaSync to transfer sensitive volumes to actor-controlled cloud storage.

• Threat Actor Profile: Technical Artifacts

  • Implementation of a hybrid encryption scheme utilizing AES-256 for file data and RSA-2048 for session key protection.
  • Behavioral and code similarities to Payload and Chaos ransomware, suggesting Dreamfyre may be a rebranded entity or splinter group.
  • Persistence established through strategic registry modifications and the creation of unauthorized scheduled tasks.

• Impact Analysis: Operational & Regulatory

  • Substantial operational downtime affecting GkNur Gıda's production capabilities and downstream supply chain stability.
  • Compromise of high-sensitivity data, including Personally Identifiable Information (PII), financial records, and operational blueprints.
  • Significant regulatory exposure and potential fines under GDPR and local data protection mandates following the public leak.

• Defensive Actions: Mitigation & IoCs

  • Immediate isolation of compromised network segments and mandatory rotation of all administrative credentials.
  • Deployment of monitoring rules to detect Dreamfyre-specific file extensions and ransom note identifiers.
  • Implementation of egress filtering to block known C2 domains and monitoring for unauthorized usage of Rclone or MegaSync.