Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Jun 22, 2020

Indiabulls Group hit by CLOP Ransomware, gets 24h leak deadline
June 22, 2020
https://www.bleepingcomputer.com/ne...it-by-clop-ransomware-gets-24h-leak-deadline/

Indian conglomerate Indiabulls Group has allegedly been hit with a cyberattack from the CLOP Ransomware operators who have leaked screenshots of stolen data.

The Indiabulls Group is an Indian conglomerate with $3.5 billion in revenue (2019), over 19,000 employees, and subsidiaries focusing on housing, personal finance and lending, infrastructure, and pharmaceuticals.
CLOP Ransomware claims to have breached Indiabulls
When performing a ransomware attack, the CLOP threat actors are known to steal unencrypted files before deploying the ransomware.
It is not known how much CLOP is demanding for a ransom or when the attack occurred.

In March, the CLOP Ransomware operators also conducted an attack against U.S pharmaceutical company ExecuPharm when they stole 163GB of unencrypted files. Since then, the ransomware actors have leaked it all on their data leak site after not being paid.
Click to expand...

guest · Jun 23, 2020

REvil ransomware scans victim's network for Point of Sale systems
June 23, 2020
https://www.bleepingcomputer.com/ne...ns-victims-network-for-point-of-sale-systems/

REvil ransomware operators have been observed while scanning one of their victim's network for Point of Sale (PoS) servers by researchers with Symantec's Threat Intelligence team.

After getting access to a target's network, the operators spread laterally while also stealing data from servers and workstations, later encrypting all the machines on the network after gaining administrative access to a domain controller.
As part of the campaign observed by Symantec, the REvil affiliates used the off-the-shelf Cobalt Strike penetration testing toolkit to deploy REvil (aka Sodinokibi) ransomware payloads on their targets' networks.
Ransom doubled within three hours
In total, the researchers found Cobalt Strike on the networks of eight firms targeted in this campaign, with the attackers infecting and encrypting three companies from the services, food, and healthcare industry sectors with the REvil ransomware.

"The companies targeted in this campaign were primarily large, even multinational, companies, which were likely targeted because the attackers believed they would be willing to pay a large ransom to recover access to their systems," Symantec explained.
Click to expand...

Each of the victims was asked to pay $50,000 worth of Monero cryptocurrency or $100,000 if a three hours deadline expired.
Scans for PoS systems

"While many of the elements of this attack are 'typical' tactics seen in previous attacks using Sodinokibi, the scanning of victim systems for PoS software is interesting, as this is not typically something you see happening alongside targeted ransomware attacks," Symantec concluded.
"It will be interesting to see if this was just opportunistic activity in this campaign, or if it is set to be a new tactic adopted by targeted ransomware gangs."
Click to expand...

Symantec: Sodinokibi: Ransomware Attackers also Scanning for PoS Software, Leveraging Cobalt Strike

It is not clear if the attackers are targeting this software for encryption or because they want to scrape this information as a way to make even more money from this attack.
Click to expand...

guest · Jun 23, 2020

mood said: ↑

Indiabulls Group hit by CLOP Ransomware, gets 24h leak deadline
June 22, 2020
https://www.bleepingcomputer.com/ne...it-by-clop-ransomware-gets-24h-leak-deadline/
Click to expand...

Updated:

Update 6/22/20: Added information about vulnerable Netscaler device.

Cyberintelligence firm Bad Packets told BleepingComputer, though, that Indiabulls has an Citrix Netscaler ADC VPN gateway exposed, which is vulnerable to the CVE-2019-19781 vulnerability.
Click to expand...

guest · Jun 24, 2020

Hackers Threaten to Auction Legal Documents Involving Mariah Carey, Nicki Minaj, MTV, More
June 24, 2020
https://variety.com/2020/music/news/mariah-carey-nicki-minaj-mtv-hackers-allen-grubman-1234648709/

In the latest twist in the data hack involving top entertainment law firm Grubman Shire Meiselas & Sacks, the party purportedly responsible for the hack, which calls itself REvil, has threatened to auction off a vast amount of sensitive documents from some of the firm’s top clients.

It laid out a schedule beginning on July 1, with docs from Mariah Carey, Nicki Minaj and Lebron James, followed two days later by Bad Boy Records, MTV and Universal, and then an unspecified one on July 5.
The first three bids start at $600,000; Bad Boy is $750,000 and the latter two $1 million.

It claims, “Each lot includes full information downloaded from the office, namely – contracts, agreements, NDA, confidential information, court conflicts [and] internal correspondence with the firm.”
Click to expand...

The note concludes with a message to law firm founder Allen Grubman, presumably referencing an earlier $42 million ransom request: “Mr. Grubman, you have a chance to stop that, and you know what to do.” Grubman has said that he will not negotiate with the hackers, equating it to negotiating with terrorists.

In a statement, a spokesperson for Grubman Shire Meiselas & Sacks said, “The most recent post is yet another desperate nuisance tactic these criminals are using to try to squeeze out a profit from stolen data. Our clients and the entertainment industry as a whole have overwhelmingly applauded the firm’s position that we will not give into extortion.”
Click to expand...

guest · Jun 24, 2020

Ransomware operators now threatening to publish stolen data in extortion demands
June 24, 2020
https://www.cyberscoop.com/ransomware-hack-leak-extortion-crowdstrike-falcon/

Ransomware attackers typically encrypt files with the promise of decryption if victims make good on hefty ransom demands.

But the status quo among ransomware operators has been shaken in the last several months, and they’re now beginning to move away from just demanding ransoms from victims. They’re also running hack-and-leak operations, according to CrowdStrike.

“[A] trend that we’re starting to see in the last couple of months is that when victims don’t pay the ransom … threat actors have actually been threatening to disclose their sensitive files. So they’re actually exfiltrating data from the victim and threatening to disclose it,” CrowdStrike vice president of intelligence Adam Meyers said Wednesday while speaking at the virtual CrowdStrike’s Fal.Con for Public Sector Conference, produced by FedScoop and CyberScoop.
Click to expand...

In at least one case, attackers auctioned stolen data to the highest bidder on a custom-built website, Meyers said.
“This is an escalation in the ransomware operations where they’re now moving into extortion in a big way because they want to maximize their returns,” Meyer said.
Click to expand...

guest · Jun 25, 2020

LG Electronics allegedly hit by Maze ransomware attack
June 25, 2020
https://www.bleepingcomputer.com/ne...nics-allegedly-hit-by-maze-ransomware-attack/

Maze ransomware operators have claimed on their website that they breached and locked the network of the South Korean multinational LG Electronics.
The details of the attack have not been released but the hackers stated that they have stolen from the company proprietary information for projects that involve big U.S. Companies.
Proprietary code stolen
The hackers told BleepingComputer that they have stolen 40GB of Python code that LG developed for large companies in the U.S.

In a teaser post from June 22 captured by cybersecurity intelligence firm Cyble, the attacker announced that they would provide more information on the LG Electronics breach and the source code they stole.
Click to expand...

Regardless of how they got in, Maze has made a reputation of publishing stolen files if they don’t reach an agreement with their victims for a ransom payment.
Click to expand...

guest · Jun 27, 2020

California University Paid $1.14 Million After Ransomware Attack
June 26, 2020
https://www.bnnbloomberg.ca/califor...-14-million-after-ransomware-attack-1.1457176

The University of California, San Francisco paid criminal hackers $1.14 million this month to resolve a ransomware attack.

The hackers encrypted data on servers inside the school of medicine, the university said Friday. While researchers at UCSF are among those leading coronavirus-related antibody testing, the attack didn’t impede its Covid-19 work, it said. The university is working with a team of cybersecurity contractors to restore the hampered servers “soon.”

“The data that was encrypted is important to some of the academic work we pursue as a university serving the public good,” it said in the statement. “We therefore made the difficult decision to pay some portion of the ransom.”
The university declined to say what was in the files that was worth more than $1 million, except that it didn’t believe patient medical records were exposed.
Click to expand...

stapp · Jun 29, 2020

mood said: ↑

California University Paid $1.14 Million After Ransomware Attack
June 26, 2020
https://www.bnnbloomberg.ca/califor...-14-million-after-ransomware-attack-1.1457176
Click to expand...

A leading medical-research institution working on a cure for Covid-19 has admitted it paid hackers a $1.14m (£910,000) ransom after a covert negotiation witnessed by BBC News.
Click to expand...

And an anonymous tip-off enabled BBC News to follow the ransom negotiations in a live chat on the dark web.
Click to expand...

https://www.bbc.co.uk/news/technology-53214783

guest · Jul 1, 2020

Ransomware gangs are doing their homework before encrypting corporate data
July 1, 2020
https://www.cyberscoop.com/ransomware-dhs-ibm-maze/

The lengthy amount of time that criminal hackers are sitting undetected on the networks of U.S. businesses is giving them powerful leverage to extort their victims, according to a Department of Homeland Security cybersecurity official.

Going unnoticed on corporate networks allows ransomware gangs to size up their victims and funnel out data before ransom negotiations even begin, said Matt Travis, deputy director of DHS’s Cybersecurity and Infrastructure Security Agency.

“They’re not just going into networks and seizing data,” Travis said Wednesday at IBM’s Think Gov Digital event, produced by FedScoop. “They’re snooping around” for balance sheets and other financial data to “gain intelligence on how much of a ransom they think they can get.”
Click to expand...

In the last three months, the criminal hackers behind the Maze ransomware have attacked two big IT service providers, one of which is a Fortune 500 company. Other ransomware gangs have hit big corporate targets, and in so doing are first locking computer systems and then publicly shaming companies that don’t pay up by dumping their data.
Click to expand...

guest · Jul 2, 2020

Electric Company Ransomware Attack Calls for $14 Million in Ransom
Light S.A., a Brazilian based electrical energy company
June 30, 2020
https://www.appgate.com/blog/electric-company-ransomware-attack-calls-for-14-million-in-ransom

The company issued comments to a local newspaper confirming the attack, however, technical details were not disclosed by the company.

Our malware analysis team had access to the binary that was likely used in the attack and we were able to confirm that the sample is from a family known as Sodinokibi (aka REvil). Althought we can't confirm that this was the exact same file used in the attack, the evidence points to being connected to the Light SA breach, such as the ransom price, for example.
Click to expand...

Ransomware Attack Asking 14,000,000 USD.
According to the page that is hosted in the deep web, the ransom amount must be paid using the virtual currency Monero, and prior to June 19, the total was 106,870.19 XMR, which is equivalent to 7 million USD. However, since the deadline has passed, the price has doubled to 14 million US dollars.
Also, it provides an online chat support, where the victim can interact with the attackers. In the images below, we can see that someone reached out to the attacker. We decided to censor the images to reduce the exposure of the person involved.
Click to expand...

guest · Jul 2, 2020

LeBron James among the 1st stars to have their stolen law firm files put up for auction
July 2, 2020
https://www.scmagazine.com/home/sec...eir-stolen-law-firm-files-put-up-for-auction/

The Sodinokibi/REvil ransomware gang has apparently made good on its threat to auction off files it lifted from celebrity law firm Grubman Shire Meiselas & Sacks.

The group on July 1 reportedly placed legal documents corresponding to Nicki Minaj, Mariah Carey and LeBron James up for bid, with the starting price set at $600,000 per lot. The next set of auctions is set for July 3 and will include documents pertaining to entertainment and media companies Bad Boy Entertainment Holdings ($750,000), Universal ($1 million) and MTV ($1 million).
Bidders can buy all of the stolen documents from all clients for $42 million, which is the amount the attackers were demanding in ransom from the law firm, which has refused to pay.
Click to expand...

Auctioning off stolen data creates another potential avenue for monetization while also ratcheting up pressure on victims to pay or at least negotiate.

“I’m not sure whether REvil actually anticipates being able to monetize this data. Who’d pay so much for legal documents? The celebrities?” said Brett Callow, threat analyst at Emsisoft.
Click to expand...

guest · Jul 4, 2020

Companies start reporting ransomware attacks as data breaches
July 4, 2020
https://www.bleepingcomputer.com/ne...eporting-ransomware-attacks-as-data-breaches/

Corporate victims are finally starting to realize that ransomware attacks are data breaches and have begun to notify employees and clients about data stolen data.

If a victim does not pay the ransom, the threat actors will publicly post the data on data leak sites created to shame the victim.
This tactic is being conducted by almost all ransomware operations, including Maze, REvil, Netwalker, DoppelPaymer, CLOP, RagnarLocker, Nephilim, Ako, and others.
Ransomware attacks are data breaches
The data stolen in these attacks can be damaging to a company as it commonly includes financials, trade secrets, unpublished reports, and emails.
Click to expand...

Numerous times in the past, employees of ransomware attacks have contacted BleepingComputer to learn more about what was stolen in an attack because the company they work for was denying it.

"Can you share what was stolen? We were just told that there were IT problems and they are denying any attack," an employee of a breached company asked BleepingComputer.
Ransomware victims start issuing data breach notifications
The good news is that corporate victims are finally starting to issue data breach notifications when affected by a ransomware attack.
Some of the companies that BleepingComputer has seen issuing data breach notifications include: [...]
Click to expand...

Minimalist · Jul 6, 2020

EDP energy giant confirms Ragnar Locker ransomware attack

EDP Renewables North America (EDPR NA) confirmed a Ragnar Locker ransomware attack that affected its parent corporation's systems, the Portuguese multinational energy giant Energias de Portugal (EDP).

EDP Group's activities are focused on electric power generation and distribution, as well as on the information technology industry sectors.

At the moment, it has over 11,500 employees, delivers energy to over 11 million customers, and is the world's 4th largest producer of wind energy and one of the largest energy sector operators (both gas and electricity) in Europe.
Click to expand...

https://www.bleepingcomputer.com/ne...ant-confirms-ragnar-locker-ransomware-attack/

guest · Jul 8, 2020

Ransomware + Exfiltration + Leaks = Data Breach
Data-Leaking Extortionists' Revised Playbook Goes Way Beyond Ransomware
July 7, 2020
https://www.inforisktoday.com/blogs/ransomware-exfiltration-leaks-data-breach-p-2913

When organizations get hit by crypto-locking malware, preceded by data exfiltration, is it right to still label these incidents as being just ransomware attacks?

Ransomware-wielding attackers keep expanding their horizons, to the point that focusing on the crypto-locking malware alone, or even calling this "cybercrime" - as opposed to just crime - too often misses the big picture, including the full repercussions of such attacks, says Raj Samani, chief scientist at McAfee.

"Crime has evolved and crime is now becoming more digitally dependent, and ransomware - what we used to call ransomware - now just comes under this category of crime," he tells me.
Data exfiltration has rewritten the rules of the ransomware game. But if there's one rule of that game, it's that nothing stays static.
Click to expand...

Minimalist · Jul 14, 2020

Collabera hacked: IT staffing'n'services giant hit by ransomware, employee personal data stolen

Hackers infiltrated Collabera, siphoned off at least some employees' personal information, and infected the US-based IT consultancy giant's systems with ransomware.
Click to expand...

https://www.theregister.com/2020/07/14/collabera_ransomware/

Minimalist · Jul 14, 2020

LiveAuctioneers reports data breach after user records sold online

LiveAuctioneers has disclosed a data breach after a well-known data breach broker began selling 3.4 million stolen user records on a hacker forum.

LiveAuctioneers is an auction site that allows people worldwide to bid on auctioned items in real-time.
Click to expand...

https://www.bleepingcomputer.com/ne...s-data-breach-after-user-records-sold-online/

Minimalist · Jul 14, 2020

Revengeful hacker leaks database info after researcher threatens to reveal identities

A hacker going by the name of NightLion apparently breached the backend servers at data leak monitoring service DataViper and exfiltrated data, including more than 8,200 databases, as an act of revenge against a security researcher who plans to reveal the identity of Shiny Hunters, Gnostic Players, #TheDarkOverlord and other subgroups.
Click to expand...

https://www.scmagazine.com/home/sec...er-researcher-threatens-to-reveal-identities/

Minimalist · Jul 14, 2020

Hacker releases database of 270 million alleged Wattpad records

An allegedly stolen Wattpad database containing 270 million records were being sold in private sales for over $100,000. Now it is being offered for free on hacker forums.
Click to expand...

https://www.bleepingcomputer.com/ne...abase-of-270-million-alleged-wattpad-records/

guest · Jul 16, 2020

Orange confirms ransomware attack exposing business customers' data
July 16, 2020
https://www.bleepingcomputer.com/ne...ware-attack-exposing-business-customers-data/

Orange has confirmed to BleepingComputer that they suffered a ransomware attack exposing the data of twenty of their enterprise customers.
Orange is a French telecommunications company that offers consumer communication services and business services to the enterprise.
Nefilim ransomware leaks Orange customer data
On July 15th, 2020, the ransomware operators behind the Nefilim Ransomware added Orange to their data leak site and stated that they breached the company through their "Orange Business Solutions" division.

Orange confirmed to BleepingComputer that they suffered a ransomware attack targeting their Orange Business Services division on the night of Saturday, July 4th, 2020, into July 5th.
Click to expand...

As part of the ransom operators' leak, a 339MB archive file was published titled 'Orange_leak_part1.rar' that contained data that was allegedly stolen from Orange during the attack.
The Ransom Leaks Twitter account, run by researchers at Perch Security, told BleepingComputer that this archive contained emails, airplane schematics, and files from ATR Aircraft, a French aircraft manufacturer.

While ATR told BleepingComputer that they "have not recently been affected by a ransomware attack," we have not received replies to our followup questions regarding their data leaked in the Orange attack.
Click to expand...

guest · Jul 17, 2020

Cloud provider stopped ransomware attack but had to pay ransom demand anyway
BlackBaud said it had to pay a ransom demand to ensure hackers would delete data they stole from its network
July 17, 2020
https://www.zdnet.com/article/cloud...e-attack-but-had-to-pay-ransom-demand-anyway/

Blackbaud, a provider of software and cloud hosting solutions, said it stopped a ransomware attack from encrypting files earlier this year but still had to pay a ransom demand anyway after hackers stole data from the company's network and threatened to publish it online.

The incident took place in May 2020, the company revealed in a press release on Thursday.
Blackbaud said hackers breached its network and attempted to install ransomware in order to lock the company's customers out of their data and servers.

"After discovering the attack, our Cyber Security team-together with independent forensics experts and law enforcement-successfully prevented the cybercriminal from blocking our system access and fully encrypting files; and ultimately expelled them from our system," the company said.
Click to expand...

The ransomware gang, which ZDNet was not able to identify before this article's publication, then threatened to release the stolen data unless Blackbaud paid a ransom demand -- even if their initial file-encrypting attack was stopped.
RANSOMWARE TREND
The Blackbaud incident is an epitome of today's double-extortion ransomware attacks.
Click to expand...

guest · Jul 18, 2020

mood said: ↑

Ransomware Strikes Third US College in a Week
June 8, 2020
https://www.infosecurity-magazine.com/news/ransomware-strikes-third-us/
Click to expand...

College to notify ransomware victims; offers credit monitoring to college community
July 17, 2020
https://columbiachronicle.com/break...victims-offers-credit-monitoring-to-employees

Nearly seven weeks after Columbia became the victim of a ransomware attack, the college provided details about how it would assist members of the college community whose data may have been compromised.

A Friday, July 17 collegewide email from Senior Vice President and Chief Financial Officer Jerry Tarrer and Associate Vice President and Chief Information Officer Kathie Koch stated that individuals whose personal data was accessed during the attack will soon receive notice of the incident through first-class mail.
On May 30 the college was named as the victim of a ransomware attack by NetWalker, a group of data hackers, as reported by the Chronicle June 2.
Click to expand...

“We take the security of all information in our control seriously and we sincerely regret any concern or inconvenience that this matter may cause you,” the email said. “Please know that we remain dedicated to improving the security and protection of your data and that this continues to be a top priority.”
Click to expand...

guest · Jul 19, 2020

Attackers use REvil ransomware to hit Texas retirement specialist
...and are threatening to leak the 2000-odd social security numbers they have collected
July 19, 2020
https://www.itwire.com/security/att...mware-to-hit-texas-retirement-specialist.html

Some data that was stolen from the company has been leaked on the dark web by the attackers, who claim that they will leak all the data on the web if they are not contacted soon.
Actuaries and Associates, a third-party retirement plan administrator, is based in Texas and has been in business since 1980.

REvil, which is also known as Sodinokibi, was first identified in April last year and is operated by the GOLD SOUTHFIELD threat group, according to the counter threat unit research team at Secureworks.
Click to expand...

guest · Jul 20, 2020

Ransomware gang demands $7.5 million from Argentinian ISP
Telecom Argentina had roughly 18,000 computers infected during a ransomware attack over the weekend
July 20, 2020
https://www.zdnet.com/article/ransomware-gang-demands-7-5-million-from-argentinian-isp/

A ransomware gang has infected the internal network of Telecom Argentina, one of the country's largest internet service providers, and is now asking for a $7.5 million ransom demand to unlock encrypted files.

Sources inside the ISP said hackers caused extensive damage to the company's network after they managed to gain control over an internal Domain Admin, from where they spread and installed their ransomware payload to more than 18,000 workstations.
The attackers have also been identified as the REvil (Sodinokibi) ransomware group, according to a now-deleted tweet showing the ransomware gang's dark web portal -- the page where victims are directed to make payments.
Click to expand...

According to a report from security firm Advanced Intel, for the past year, the REvil gang has specialized in carrying out network-based intrusions, targeting unpatched networking equipment as the entry point into victim organizations, and before spreading laterally through a company's network.

The REvil ransomware gang also maintains a dakr web portal where it leaks data it stole from infected hosts in case the companies don't pay.
This is also the REvil gang's second attack against the network of an internet service provider. The REvil gang also targeted Sri Lanka Telecom, the larged fixed telephony providers in Sri Lanka, in May.
Click to expand...

guest · Jul 20, 2020

Lorien Health Services discloses ransomware attack affecting nearly 50,000
July 20, 2020
https://www.bleepingcomputer.com/ne...es-ransomware-attack-affecting-nearly-50-000/

Lorien Health Services in Maryland announced that it was the victim of a ransomware incident in early June. Data was stolen and then encrypted during the incident.

Responsible for the attack are Netwalker ransomware operators, who leaked the information after Lorien refused to pay the ransom demand.
Social Security numbers accessed
The company says that the incident was detected on June 6 and contracted services of cybersecurity experts to start an investigation and determine the impact.
According to the breach notification sent to the Secretary of Health and Human Services, the number of impacted individuals is 47,754.

Although Lorien just announced the breach publicly, Netwalker operators made the incident known in mid-June, publishing screenshots of directory listings with 2020 date stamps and admission records as proof of compromise.
Click to expand...

Netwalker leaks Lorien data
At the moment, some of the data has been dumped online. A password-protected archive of 147MB is currently available via a file-sharing service.
The hackers also published the unlock key for the archive and labeled this cache "Part 1," indicating that they may leak more data in the future.
Click to expand...

guest · Jul 22, 2020

County judge: Public’s info compromised in cyberattack
July 20, 2020
https://www.gainesvilleregister.com...cle_00702df4-cad4-11ea-841f-830160f5e883.html

A cyberattack on the Cooke County Sheriff’s Office compromised people’s personal information, County Judge Jason Brinkley said.
A press release issued Monday, July 20, states a ransomware attack on the county’s information system for the CCSO on July 4 resulted in a data breach of personal identification information.

“This is the first major security breach that I am aware of for Cooke County,” Brinkley said when asked when the last time was that the county faced a security breach.
Shortly after the data breach, ITWire, an Australian information technology news website, reported that attackers claimed to have used REvil ransomware to attack the Cooke County website.

Screenshots from the attackers’ announcement about the hack showed data folders with filenames that appeared to reflect archived case files as well as current cases. [...] the files would be uploaded in seven days [...]
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

stapp Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

stapp Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches