REvil hacking group attacks US nuclear weapons contractor
There’s no indication the stolen data includes classified or critical security-related information
The same gang behind the REvil ransomware-as-a-service operation has attacked US nuclear weapons contractor Sol Oriens. The criminals claimed they would auction the data stolen during the attack.
The REvil ransomware cyber crime gang recently listed organizations whose data it was selling to the highest bidder — one of those companies was Sol Oriens. To prove they had the data, the hackers posted images of a hiring overview document and other corporate documents.
After the hackers published the images, Sols Oriens confirmed an attack occurred in May 2021. CNBC reporter Eamon Javers shared the confirmation on Twitter.
“The investigation is ongoing, but we recently determined that an unauthorized individual acquired certain documents from our systems,” the statement read. “Those documents are currently under review, and we are working with a third-party technological forensic firm to determine the scope of potential data that may have been involved.”
“We have no current indication that this incident involves client classified or critical security-related information. Once the investigation concludes, we are committed to notifying individuals and entities whose information is involved.”
Martin Jartelius, CSO at Outpost24, told ITPro the REvil gang depends largely on subcontractors making the initial breaches. After the initial breach, the REvil gang executes the ransom component.
“While the target is highly interesting, we hence should note that Russian interests have access to this capability and the implications this carries for the supply-chain – in this case, we saw ransomware but that was the option chosen by the attacker once they had access,” said Jartelius. “Ransomware is the symptom, not the cause of ailment. We hope that the breach in and of itself does not cause unnecessary instability on a larger scale, on the positive side different threat actors have recently kicked so many hornets' nests in a short period of time, soon one or more are bound to be stung."
Paul Norris, senior systems engineer EMEA at Tripwire, told ITPro that groups like REvil have been wildly successful at monetizing data exfiltrated from their victims.
“We should hope that Sol Oriens is prepared to respond to ransomware, including the potential operational disruptions that come with that response. But while we tend to focus on the response to ransomware, prevention is still the best way to deal with the threat,” said Norris. “Ransomware doesn’t magically appear on systems, and the methods by which it’s introduced into an environment are generally well-understood phishing, vulnerability exploits, and misconfigurations, which is why hardening systems helps to safeguard the integrity of your digital assets and protect against vulnerabilities."
-
Cisco sounds alarm over new Russian malware campaign hitting firms in US and EuropeNews UAT-11795 is weaponizing legitimate software such as WebEx and Zoom to dupe victims
-
Why doesn't more data produce better results?ITPro Podcast Riverbed CIO Fernando Castanheira talks about data and how businesses can use it better
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
