Hacking group leaks Nvidia data following alleged ransomware attack
LAPSU$ claims to have released Nvidia source code and highly confidential GPU driver data
The ransomware group that claimed to be behind last week’s Nvidia cyber attack has released part of the data it stole from the company.
Nvidia was the victim of a ransomware attack last week, according to a Bloomberg source. The incident wasn’t connected to the Ukraine conflict and, at the time, looked to be relatively minor.
However, the attack may have been more serious than first thought, as Nvidia’s email systems and developer tools reportedly suffered outages as a result, according to the Telegraph.
A source told the publication that the intrusion had completely compromised the company’s internal systems, although some email services did return on Friday. At the time it was unclear whether any data had been stolen or deleted from the company.
Today, the extortion group LAPSU$ announced it has leaked part one of Nvidia data, which apparently contains source code and highly confidential or secret data from various parts of Nvidia’s GPU drivers, according to Telegram posts made by the group and seen by cyber security researcher Soufiane Tahiri.
The group included a download link to the data in its post, although this is yet to be verified.
LAPSU$ took responsibility for the attack on 26 February, saying it breached Nvidia and exfiltrated over 1TB of data. It planned to leak all Nvidia employees passwords and NTLM hashes.
However, LAPSU$ also claimed that Nvidia launched a ransomware attack of its own on the group in retaliation. The group called the company criminals, underlining it was fortunate it had backed up its data.
LAPSU$ said that Nvidia was able to carry out the hack as access to Nvidia’s employee VPN requires the PC to be enrolled in mobile device management. Through this, the company was able to connect to a virtual machine the hacking group uses.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
“Yes they successfully encrypted the data,” wrote the group in a Telegram post. “However we have a backup and it’s safe from scum!!!”
The group also said it didn’t plan to leak the data, but Nvidia made the “scummy move” to try and delete its personal data.
“We are investigating an incident,” a spokesperson from Nvidia told IT Pro. “Our business and commercial activities continue uninterrupted. We are still working to evaluate the nature and scope of the event and don't have any additional information to share at this time."
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
