The International Ransomware Attack Targets Swissmem

Swissmem, Switzerland’s leading industry association representing over 1,200 mechanical and electrical engineering firms, has reportedly suffered a significant ransomware attack by the Hunters International cybercrime group.

The attackers claim to have exfiltrated 456 GB of sensitive data, including proprietary technical specifications, financial records, and member organization details.

Hunters International has threatened to leak the stolen information publicly within 4–5 days if ransom demands are not met.

The breach underscores the escalating risks to Switzerland’s critical industrial sector, which has seen 70% of its companies targeted by cyberattacks in the past two years.

Hunters International’s Expanding Global Campaign

According to the post from FalconFeeds.io, Hunters International, a ransomware-as-a-service (RaaS) operation active since late 2023, has rapidly become a pervasive threat to global industries.

Emerging from the remnants of the Hive ransomware group—which the FBI dismantled in January 2023—the group repurposed Hive’s code to refine its encryption and extortion tactics.

Recent high-profile targets include the U.S. Marshals Service, the Industrial and Commercial Bank of China (ICBC), and manufacturing conglomerate Schlatter Group.

The group employs a double extortion model, encrypting systems while exfiltrating data to pressure victims into paying ransoms.

Swissmem’s breach aligns with Hunters International’s pattern of targeting organizations with access to high-value intellectual property and cross-border supply chain data.

Attack Methodology and Swiss Industrial Vulnerabilities

The attack on Swissmem mirrors Hunters International’s signature tactics.

The group likely exploited vulnerabilities in public-facing servers, such as Oracle WebLogic, to deploy Rust-based ransomware designed to evade detection.

Once inside Swissmem’s network, attackers typically escalate privileges using tools like Impacket, disable security protocols, and exfiltrate data via cloud storage platforms.

Switzerland’s industrial sector remains a lucrative target due to its concentration of specialized manufacturing firms and historically underfunded cybersecurity infrastructure.

A 2024 survey revealed that 43% of Swissmem members lack dedicated incident response teams, leaving them exposed to advanced threats.

The breach follows a 2023 ransomware incident at Swiss technology firm ABB, attributed to Russian-aligned actors.

Implications for Swiss Industry and Cybersecurity Posture

The Swissmem breach could disrupt Switzerland’s $250 billion engineering sector, which contributes 32% of the nation’s exports.

Compromised data may include blueprints for precision machinery, client contracts, and export control documents—assets critical to maintaining Switzerland’s competitive edge.

While Swissmem has not confirmed the attack’s operational impact, the association advised members to “review access controls” and monitor for suspicious activity.

Cybersecurity experts urge immediate adoption of AI-driven threat detection, mandatory employee training, and air-gapped backups to mitigate risks.

As Hunters International continues targeting critical infrastructure globally, the incident highlights the urgent need for coordinated defense strategies among Swiss industrial firms.

The deadline imposed by Hunters International leaves Swissmem with limited options: negotiate with criminals risking further exploitation, or refuse and endure potentially catastrophic data leaks.

Either outcome will likely accelerate regulatory reforms in Switzerland’s approach to industrial cybersecurity.

Also Read:

Alleged Data Breach at Iranian Social Media App Nazdika Sparks Security Concerns

See more