SETTRA Ransomware Group Behind Cyberattack on Auto Importer Kolmobil

The SETTRA ransomware group is behind the cyberattack targeting Kolmobil, Israel's largest automotive importer, two weeks after the initial breach occurred. According to industry sources, the criminal syndicate specializes in double extortion tactics, which involve exfiltrating sensitive data and encrypting corporate IT systems to disrupt operations and coerce management into paying a ransom.

Following the cyberattack, the Israeli Ministry of Transport temporarily blocked Kolmobil's access to the national vehicle registration system, known as "Rarkavit", which is critical for processing new car imports. Kolmobil commands a substantial share of the Israeli automotive market, delivering 62,657 new vehicles during the first nine months of the year, representing 24.5% of total market sales. The company imports several major global brands, including Mercedes-Benz, Hyundai, Mitsubishi, ORA, and Jaecoo.

While Kolmobil declined to clarify whether a ransom was paid to the hackers, company representatives stated that normal operations have fully resumed. "The company has returned to full activity. No data has been exposed publicly, and Kolmobil operates with complete transparency to protect its customers," management said in an official statement. Cybersecurity experts note that SETTRA typically avoids critical infrastructure and government targets, focusing instead on commercial enterprises with promises to delete stolen data upon receiving payment.