REvil hacking group attacks US nuclear weapons contractor
There’s no indication the stolen data includes classified or critical security-related information
The same gang behind the REvil ransomware-as-a-service operation has attacked US nuclear weapons contractor Sol Oriens. The criminals claimed they would auction the data stolen during the attack.
The REvil ransomware cyber crime gang recently listed organizations whose data it was selling to the highest bidder — one of those companies was Sol Oriens. To prove they had the data, the hackers posted images of a hiring overview document and other corporate documents.
After the hackers published the images, Sols Oriens confirmed an attack occurred in May 2021. CNBC reporter Eamon Javers shared the confirmation on Twitter.
“The investigation is ongoing, but we recently determined that an unauthorized individual acquired certain documents from our systems,” the statement read. “Those documents are currently under review, and we are working with a third-party technological forensic firm to determine the scope of potential data that may have been involved.”
“We have no current indication that this incident involves client classified or critical security-related information. Once the investigation concludes, we are committed to notifying individuals and entities whose information is involved.”
Martin Jartelius, CSO at Outpost24, told ITPro the REvil gang depends largely on subcontractors making the initial breaches. After the initial breach, the REvil gang executes the ransom component.
“While the target is highly interesting, we hence should note that Russian interests have access to this capability and the implications this carries for the supply-chain – in this case, we saw ransomware but that was the option chosen by the attacker once they had access,” said Jartelius. “Ransomware is the symptom, not the cause of ailment. We hope that the breach in and of itself does not cause unnecessary instability on a larger scale, on the positive side different threat actors have recently kicked so many hornets' nests in a short period of time, soon one or more are bound to be stung."
Paul Norris, senior systems engineer EMEA at Tripwire, told ITPro that groups like REvil have been wildly successful at monetizing data exfiltrated from their victims.
“We should hope that Sol Oriens is prepared to respond to ransomware, including the potential operational disruptions that come with that response. But while we tend to focus on the response to ransomware, prevention is still the best way to deal with the threat,” said Norris. “Ransomware doesn’t magically appear on systems, and the methods by which it’s introduced into an environment are generally well-understood phishing, vulnerability exploits, and misconfigurations, which is why hardening systems helps to safeguard the integrity of your digital assets and protect against vulnerabilities."
-
How Spring Branch ISD overcame the CrowdStrike outage with Everpure backupsCase study The Texas school district was back up and running swiftly despite significant challenges
-
Nationwide targets private cloud gains with VMware Cloud Foundation dealNews The expanded collaboration will establish a unified private cloud platform for the high street lender
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
