Qbot trojan was found on the Edward Don network

Jun 11, 2021 06:11 GMT  ·  By

Edward Don, a food delivery company, was hit by a ransomware attack that forced the company to lock down part of its network to prevent the infection from spreading, according to Bleeping Computer.  

Edward Don is a major distributor of foodservice equipment and supplies, including kitchen accessories, bar supplies, cutlery, and tableware. Unfortunately, it fell victim of a ransomware attack earlier this week that disrupted company operations, including phone lines, networks, and email.

Due to the email outage, employees have been using Gmail accounts to communicate with customers about urgent orders or fulfillment issues.

Edward Don has yet to officially announce the incident, but employees have maintained that they will not accept new orders until systems are restored.

As Edward Don is a major distributor of foodservice products, the attack is likely to have a significant impact on the supply chain for hospitals, restaurants, hotels, and bars. BleepingComputer has attempted to contact Edward Don but has not received a response yet.

The Qbot trojan was discovered on the Edward Don network 

At this point, it is unclear who carried out the attack. However, the CEO of Advanced Intel Vitali Kremez informed BleepingComputer that the company may have been affected by Qbot due to its hostile visibility.

Qbot is known to work with ransomware operations to give them remote access to compromised networks. The remote access is used to spread laterally across a network, steal data, and eventually install the ransomware to encrypt devices.

Over the past two months, ransomware has caused significant damage to vital infrastructure and the supply chain, with recent attacks on Colonial Pipeline and food manufacturer JBS.  Following the attacks, Colonial Pipeline paid a $4.4 million ransom to DarkSide, and JBS paid an $11 million ransom to REvil.

Previously, the ProLock and Egregor ransomware groups collaborated with Qbot. REvil is said to be using the botnet since its demise. The latest cyberattack came after REvil stated that it is not afraid of the ransomware focus of the United States and will attack more organizations in the country.