Canon hit by suspected Maze ransomware attack
Two dozen domains and a host of internal services have been knocked offline
Hackers have reportedly targeted Canon’s US-based services with the notorious Maze ransomware, rendering various services offline and compromising 10TB of data.
The alleged cyber attack has affected a number of services, including Canon’s email, Microsoft Teams, its US website and several internal applications, according to Bleeping Computer, with users also unable to access various domains.
The publication obtained a partial screenshot of an alleged ransom note and also liaised with the ransomware operators, who claimed they conducted their attack yesterday, stealing “10 terabytes of data, private databases etc” in the process.
“We are aware that Canon USA are experiencing system issues – an investigation is currently taking place," a spokesperson told IT Pro. "We can confirm however that this is unrelated to the data loss we experienced on image.canon earlier this week.”
UK sites and servies appear to be unaffected by the attack.
The hackers behind Maze have been prolific in recent months, targeting a vast number of enterprises during 2020. Aerospace services provider VT San Antonio Aerospace (VT SAA), for example, was affected in June, while Xerox was among a handful of high-profile victims last month, with the ransomware group stealing more than 100GB files from the legacy printing giant.
This is in addition to the major attack on the IT services provider Cognizant earlier this year, which led to the company announcing it could lose up to $70 million as a direct result.
Canon’s IT department reportedly distributed a message to its employees yesterday morning suggesting its US-based systems were experiencing widespread issues, affecting multiple applications, including emails and use of Microsoft Teams.
Several domains are also out of action at the time of writing, with senior security advisor with Sophos, John Shier, suggesting this could be as many as 24 services. Among these are canonusa.com, canonhelp.com and canonbroadcast.com.
“Following other recent high profile attacks, this latest salvo should be a wake-up call to all enterprises that haven't taken the time to assess their security posture and bolster their defences against these pernicious adversaries,” Shier said.
“Many of these attacks start by exploiting external services or simple phishing campaigns. Successful campaigns will often be followed by living-off-the-land techniques, abusing over-privileged and under-protected accounts, and hiding in plain sight.”
He added that enterprises must take the time to build a strong security foundation which includes multi-factor authentication (MFA) everywhere, regular patching, and user training.
-
US gov makes $2bn investment in domestic quantum firmsNews The Department of Commerce says it wants to strengthen the country's presence in this critical technology sector
-
Data center industry faces ticking power time bombNews Technical and regulatory hurdles make colocation unscalable for most developers, Wood Mackenzie has warned
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recoveryNews Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacks
News Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
