ATF Confirms System Breach Following Qilin Ransomware Attack Claims

The US Bureau of Alcohol, Tobacco, Firearms and Explosives confirms a system breach following ransomware claims. The Qilin ransomware gang added the federal agency to its dark web extortion portal on Wednesday. The compromised environment operated entirely separately from the primary ATF enterprise network and eForms systems. The agency immediately terminated connections to the affected standalone system and initiated a joint forensic investigation with the Department of Justice. Since surfacing in August 2022, the Qilin operation has claimed more than 2,200 victims globally. "The impacted system operates separately from the ATF enterprise network, and there is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system." — ATF Federal IT teams are finally learning to airgap their environments, but standard ransomware operators breaching a tier-one agency proves they're still running legacy infrastructure on borrowed time.