Hack of CDK Global Disrupts U.S. Auto Dealerships

A cyberattack on software maker CDK Global has disrupted operations at auto dealerships across the United States. This incident is part of a growing trend where ransom-demanding cybercriminals target major companies through their software suppliers.

Impact on Auto Dealerships

CDK Global produces software widely used by car dealerships to process sales and other transactions. Following the hack, many dealerships have resorted to manual processing, according to local press reports.

Who is BlackSuit?

The hacking group behind the CDK Global breach is known as BlackSuit. This relatively new cybercriminal team emerged in May 2023, having spun off from the well-known Russia-linked hacking group RoyalLocker. RoyalLocker, a formidable hacker group, originated from another prolific gang named Conti. While RoyalLocker was highly active, BlackSuit appears less aggressive, with fewer victims listed on its data leak site. Analysts suggest it does not have as many hacking partners as larger ransomware gangs.

Kimberly Goody, head of cybercrime analysis at Mandiant Intelligence, noted, “The majority of BlackSuit victims have been overwhelmingly based in the U.S., followed by the U.K. and Canada, spanning a wide range of sectors.”

BlackSuit’s Reach and Operations

According to security firm Recorded Future, BlackSuit has breached at least 95 organizations globally, with the real number likely being much higher. Most victims have been American organizations in sectors such as industrial goods and education. A blog post from the security firm ReliaQuest highlighted that Russian-speaking threat actors affiliated with BlackSuit have been seeking partnerships in underground forums to gain access to companies.

BlackSuit employs a method known as “double extortion,” where they steal sensitive data from their victims, lock up systems, and threaten to leak the information unless a ransom is paid. Mandiant’s Goody explained that BlackSuit also supports smaller partner groups, providing hacking infrastructure and resources for extortion-related activities, such as harassing victims or taking down websites to pressure them into paying.