Security

Maze ransomware gang threatens to publish sensitive stolen data after US aerospace biz sensibly refuses to pay

Bungling cybercrooks throw toys out of the pram as negotiations shut down


The Maze ransomware gang has threatened to publish information stolen from an American firm that overhauls airliners and installs flight control software upgrades – because its victim refused to pay a demanded ransom.

In a "press release" published on its leaks website, Maze raged against victims who refused to play its game and cough up vast sums of money to decrypt their illicitly encrypted data.

Among those recent targets was VT San Antonio Aerospace, a maintenance, repair and overhaul (MRO) company in Texas. A subsidiary of ST Engineering, VT San Antonio was said to have lost 1.5TB of data to the Maze criminals. Its MRO customers include Air Canada, Fedex and UPS Airlines.

Earlier this week the Maze gang highlighted ST Engineering for not paying the ransom, a sensible action that busts the gang's business model.

'Work pressure' sees Maze ransomware gang demand payoff from wrong company

READ MORE

In its post the gang complained that ST Engineering's ransom negotiator "lied" before declining to take part in "further negotiation" with them, promising: "Soon it will be the time for weapon contacts, contracts for alteration of airplanes for first persons, contracts with dictatorship countries, contacts for cybersecurity systems for government structures. We just can't understand what cybersecurity they are talking about as they have an Australia size security hole in their security perimeter."

Ed Onwe, veep and general manager of VT San Antonio Aerospace, told The Register that local authorities had been informed of the ransomware attack as the firm figured out how to respond to the initial infection, adding: "As part of this process, we are conducting a rigorous review of the incident and our systems to ensure that the data we are entrusted with remains safe and secure. This includes deploying advanced tools to remediate the intrusion and to restore systems.

"We are committed to responding to this incident transparently and proactively, and already have begun notifying potentially affected customers. We will be working with our customers and industry peers to share insights and any lessons learned so that they can learn from our experience."

The Maze gang has stepped up its public-facing activities in recent weeks, not without cost to itself. Last week it sent a ransom demand to the wrong company, having mixed up two firms' names. It has also targeted Posh Spice's perfumers and other celebrity lawyers, about whom El Reg will be writing more soon. Its tactics include leaking selected files publicly to apply further pressure to victims, in the hope they pay the demanded ransom, as well as – it now seems – ranting away when they refuse to play the game.

Current British government advice is never to pay a ransomware demand: it not only encourages and enriches the crooks but there's no guarantee that they'll delete your data as they promise. ®

Send us news
43 Comments

HelloXD ransomware bulked up with better encryption, nastier payload

Russian-based group doubles the extortion by exfiltrating the corporate data before encrypting it.

Windows and Linux systems are coming under attack by new variants of the HelloXD ransomware that includes stronger encryption, improved obfuscation and an additional payload that enables threat groups to modify compromised systems, exfiltrate files and execute commands.

The new capabilities make the ransomware, first detected in November 2021 - and the developer behind it even more dangerous - according to researchers with Palo Alto Networks' Unit 42 threat intelligence group. Unit 42 said the HelloXD ransomware family is in its initial stages but it's working to track down the author.

"While the ransomware functionality is nothing new, during our research, following the lines, we found out the ransomware is most likely developed by a threat actor named x4k," the researchers wrote in a blog post.

Continue reading

Unpatched Exchange server, stolen RDP logins... How miscreants get BlackCat ransomware on your network

Microsoft details this ransomware-as-a-service

Two of the more prolific cybercriminal groups, which in the past have deployed such high-profile ransomware families as Conti, Ryuk, REvil and Hive, have started adopting the BlackCat ransomware-as-as-service (RaaS) offering.

The use of the modern Rust programming language to stabilize and port the code, the variable nature of RaaS, and growing adoption by affiliate groups all increase the chances that organizations will run into BlackCat – and have difficulty detecting it – according to researchers with the Microsoft 365 Defender Threat Intelligence Team.

In an advisory this week, Microsoft researchers noted the myriad capabilities of BlackCat, but added the outcome is always the same: the ransomware is deployed, files are stolen and encrypted, and victims told to either pay the ransom or risk seeing their sensitive data leaked.

Continue reading

DeadBolt ransomware takes another shot at QNAP storage

Keep boxes updated and protected to avoid a NAS-ty shock

QNAP is warning users about another wave of DeadBolt ransomware attacks against its network-attached storage (NAS) devices – and urged customers to update their devices' QTS or QuTS hero operating systems to the latest versions.

The latest outbreak – detailed in a Friday advisory – is at least the fourth campaign by the DeadBolt gang against the vendor's users this year. According to QNAP officials, this particular run is encrypting files on NAS devices running outdated versions of Linux-based QTS 4.x, which presumably have some sort of exploitable weakness.

The previous attacks occurred in January, March, and May.

Continue reading

Beijing-backed attackers use ransomware as a decoy while they conduct espionage

They're not lying when they say 'We stole your data' – the lie is about which data they lifted

A state-sponsored Chinese threat actor has used ransomware as a distraction to help it conduct electronic espionage, according to security software vendor Secureworks.

The China-backed group, which Secureworks labels Bronze Starlight, has been active since mid-2021. It uses an HUI loader to install ransomware, such as LockFile, AtomSilo, Rook, Night Sky and Pandora. But cybersecurity firm Secureworks asserts that ransomware is probably just a distraction from the true intent: cyber espionage.

"The ransomware could distract incident responders from identifying the threat actors' true intent and reduce the likelihood of attributing the malicious activity to a government-sponsored Chinese threat group," the company argues.

Continue reading

Costa Rican government held up by ransomware … again

Also US warns of voting machine flaws and Google pays out $100 million to Illinois

In brief Last month the notorious Russian ransomware gang Conti threatened to overthrow Costa Rica's government if a ransom wasn't paid. This month, another band of extortionists has attacked the nation.

Fresh off an intrusion by Conti last month, Costa Rica has been attacked by the Hive ransomware gang. According to the AP, Hive hit Costa Rica's Social Security system, and also struck the country's public health agency, which had to shut down its computers on Tuesday to prevent the spread of a malware outbreak.

The Costa Rican government said at least 30 of the agency's servers were infected, and its attempt at shutting down systems to limit damage appears to have been unsuccessful. Hive is now asking for $5 million in Bitcoin to unlock infected systems.

Continue reading

Even Russia's Evil Corp now favors software-as-a-service

Albeit to avoid US sanctions hitting it in the wallet

The Russian-based Evil Corp is jumping from one malware strain to another in hopes of evading sanctions placed on it by the US government in 2019.

You might be wondering why cyberextortionists in the Land of Putin give a bit flip about US sanctions: as we understand it, the sanctions mean anyone doing business with or handling transactions for gang will face the wrath of Uncle Sam. Evil Corp is therefore radioactive, few will want to interact with it, and the group has to shift its appearance and operations to keep its income flowing.

As such, Evil Corp – which made its bones targeting the financial sector with the Dridex malware it developed – is now using off-the-shelf ransomware, most recently the LockBit ransomware-as-a-service, to cover its tracks and make it easier to get the ransoms they demand from victims paid, according to a report this week out of Mandiant.

Continue reading

Now Windows Follina zero-day exploited to infect PCs with Qbot

Data-stealing malware also paired with Black Basta ransomware gang

Miscreants are reportedly exploiting the recently disclosed critical Windows Follina zero-day flaw to infect PCs with Qbot, thus aggressively expanding their reach.

The bot's operators are also working with the Black Basta gang to spread ransomware in yet another partnership in the underground world of cyber-crime, it is claimed.

This combination of Follina exploitation and its use to extort organizations makes the malware an even larger threat for enterprises. Qbot started off as a software nasty that raided people's online bank accounts, and evolved to snoop on user keystrokes and steal sensitive information from machines. It can also deliver other malware payloads, such as backdoors and ransomware, onto infected Windows systems, and forms a remote-controllable botnet.

Continue reading

Healthcare organizations face rising ransomware attacks – and are paying up

Via their insurance companies, natch

Healthcare organizations, already an attractive target for ransomware given the highly sensitive data they hold, saw such attacks almost double between 2020 and 2021, according to a survey released this week by Sophos.

The outfit's team also found that while polled healthcare orgs are quite likely to pay ransoms, they rarely get all of their data returned if they do so. In addition, 78 percent of organizations are signing up for cyber insurance in hopes of reducing their financial risks, and 97 percent of the time the insurance company paid some or all of the ransomware-related costs.

However, while insurance companies pay out in almost every case and are fueling an improvement in cyber defenses, healthcare organizations – as with other industries – are finding it increasingly difficult to get insured in the first place.

Continue reading

$6b mega contract electronics vendor Sanmina jumps into zero trust

Company was an early adopter of Google Cloud, which led to a search for a new security architecture

Matt Ramberg is the vice president of information security at Sanmina, a sprawling electronics manufacturer with close to 60 facilities in 20 countries on six continents and some 35,000 employees spread across the world.

Like most enterprises, Sanmina, a big name in contract manufacturing, is also adapting to a new IT environment. The 42-year-old Fortune 500 company, with fiscal year 2021 revenue of more than $6.76 billion, was an early and enthusiastic adopter of the cloud, taking its first step into Google Cloud in 2009.

With manufacturing sites around the globe, it also is seeing its technology demands stretch out to the edge.

Continue reading

If you didn't store valuable data, ransomware would become impotent

Start by pondering if customers could store their own info and provide access

Column Sixteen years ago, British mathematician Clive Humby came up with the aphorism "data is the new oil".

Rather than something that needed to be managed, Humby argued data could be prospected, mined, refined, productized, and on-sold – essentially the core activities of 21st century IT. Yet while data has become a source of endless bounty, its intrinsic value remains difficult to define.

That's a problem, because what cannot be valued cannot be insured. A decade ago, insurers started looking at offering policies to insure data against loss. But in the absence of any methodology for valuing that data, the idea quickly landed in the "too hard" basket.

Continue reading