Hackers auction stolen CD Projekt data with ‘charity fundraiser'
Hacker announcement discovered on a Tor site likely linked to 'HelloKitty' ransomware gang
The hackers involved in last month’s cyber attack on game developer CD Projekt are auctioning off the stolen data in a self-described “charity fundraising”, new evidence suggests.
The Polish developer, known for games such as Cyberpunk 2077 and The Witcher, was hit by a ransomware attack in early February which saw hackers obtain documents containing accounting, administration, legal, HR, and investor relations information.
New evidence from security software provider Emsisoft, which had previously identified the cyber criminals as the ‘HelloKitty’ ransomware gang, suggests that the hackers have organised a “charity fundraising” event, offering passwords to CD Projekt’s stolen data as rewards.
Emsisoft threat analyst Brett Callow told IT Pro that the announcement from the hackers had been found on a Tor site likely belonging to ‘HelloKitty’. Upon further examination, Callow found that the public torrent file created by the ransomware gang dates back to 13 March.
“The Tor site would probably have been created on or shortly after then,” the threat analyst told IT Pro.
The invitation to the “charity fundraising”, which is likely to financially benefit only the hackers themselves, lists the “donation rewards” as “archive passwords for 10k$ [sic] each”, which would allow the fundraising winners to access “source and assets” to games including The Witcher 3 and last year’s CyberPunk 2077.
This is in line with previous predictions made by Emsisoft CTO Fabian Wosar, who last month told IT Pro that the data obtained by ‘HelloKitty’ would “most likely be leaked”.
The hackers added that other data stolen from CD Projekt, including “company reports, NDA”, would be “shared with [the] media” but not with the general public. However, the ransomware gang didn’t elaborate on which publications would obtain the stolen data.
The note was signed off with a request to Tesla CEO Elon Musk, asking him to purchase large quantities of Bitcoin in order to increase the demand and price of the cryptocurrency. Last month, the company announced that it had purchased over £1 billion worth of Bitcoin and was planning to accept the currency as a payment method for its products.
CD Projekt was not immediately available for comment.
-
Opera browser thinks it has the solution to stopping ClickFix malware attacksNews The browser company is targeting a growing source of malicious links with its new Paste Protect feature
-
'Always on' culture is pushing Brits to breaking point – and nearly half are ready to quitNews Growing performance expectations and poor work-life balance are forcing some workers to consider career moves
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
