Conduent targeted by Maze ransomware attack
IT services provider was brought to a standstill for more than ten hours
IT services provider Conduent has revealed that it was the victim of a Maze ransomware attack on 29 May, which brought its systems to a standstill for more than ten hours.
The malicious attack successfully disrupted the firm's European operations after targeting a vulnerability in Citrix VPN appliances in the early hours of the morning. Conduent said it had managed to get most of its systems back online by 10 am, with all operations now back to normal.
"Conduent's European operations experienced a service interruption on Friday, May 29, 2020. Our system identified ransomware, which was then addressed by our cybersecurity protocols," stated a Congruent spokesman.
"This interruption began at 12.45 AM CET on May 29th with systems mostly back in production again by 10.00 AM CET that morning, and all systems have since then been restored.
Conduent said the incident resulted in a "partial interruption" to the services it provides to some of its clients and it is currently looking into its security setup.
"As our investigation continues, we have on-going internal and external security forensics and antivirus teams reviewing and monitoring our European infrastructure," the company added.
As reported by Computer Business Review, the company stopped short of naming the type of ransomware or intrusion vector involved – but the Maze ransomware group posted stolen data from Conduent to its Dark Web page.
Security researchers at Bad Packets believe that Conduent had been running unpatched Citrix VPNs for at least eight weeks prior to the event, despite Citrix issuing a patch on 24 January.
Attackers exploited an arbitrary code execution vulnerability known as CVE-2019-19781, which has become a common target point for ransomware groups such as Maze.
Citrix said the vulnerability was found in Citrix Application Delivery Controller (ADC) and Citrix Gateway (both formerly under the Netscaler name), which can provide attackers with an unauthenticated route in to perform arbitrary code execution. The firm advised users to upgrade vulnerable appliances as soon as possible.
Back in April, Maze also targeted IT services provider Cognizant in an attack that reports say could cost the firm anywhere between $50 and $70 million.
-
Flaws in some of the most popular AI coding tools left developers wide open to attackNews Malicious repositories can trick advanced AI agents into silently breaking out of their workspace sandboxes
-
The memory shortage is hitting PC sales hard, but vendor revenues are still growingNews AI-driven component shortages are hurting PC sales, but device vendors are recording solid revenue growth
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
