IoT chip maker Advantech confirms ransomware attack, data breach
The Conti ransomware gang was the responsible to hit the systems of Advantech and is now demanding a $14 million ransom to decrypt affected systems and to stop leaking stolen company data, as confirmed by BleepingComputer, techno news website.
Advantech was the world industrial computing leader with a 34% WW Market Share in 2018 and it reported yearly sales revenue of over $1.7 billion in 2019.
The Conti operators behind the attack on Advantech's network have set a ransom of 750 BTC (roughly $12,600,000 at today's exchange rate) for full data decryption and for removing stolen data from their servers according to a chat log seen by BleepingComputer.
Conti also said that they are willing to decrypt two of the encrypted files before the ransom is paid as proof that their decryptor works.
The ransomware operators added on November 21, 2020, that they will leak part of the stolen data if there was no reply from the company within the next day.
November 26 saw the group publishing Advantech's data on their ransomware data leak site as a 3.03GB archive with 2% of the stolen data and a text document with a list of files included in the ZIP archive.
The ransomware gang also assured to remove off any backdoors deployed on the company's network and will provide security tips on how to secure the network to block future breaches, against ransom paid.
They also said that any stolen data would be deleted once the payment goes through. Despite their promises, research by ransomware negotiation firm Coveware has shown that some ransomware operations don't actually remove deleted files after a ransom payment is made.
While the company has not issued any public statements regarding the ransomware attack on its systems, a copy was obtained of the ransom note the Conti operators deployed on Advantech's encrypted systems.
An Advantech spokesperson confirmed the ransomware attack and that data was stolen from the company's systems but did not comment on Conti's ransom demands.
Conti ransomware was first spotted in isolated attacks at the end of December 2019, with attacks picking up in June 2020.
This ransomware shares code with the notorious Ryuk Ransomware and began being distributed through reverse shells opened by the TrickBot Trojan after Ryuk activity dwindled down in July 2020.
Conti operators breach corporate networks and spread laterally until they gain access to domain admin credentials that allow them to deploy the ransomware payloads used to encrypt devices.
Operating as a private Ransomware-as-a-Service (RaaS) that recruits experienced hackers to deploy the ransomware in exchange for large ransom shares; Conti opened their own data leak site with twenty-six victims in August 2020.
See What’s Next in Tech With the Fast Forward Newsletter
Tweets From @varindiamag
Nothing to see here - yet
When they Tweet, their Tweets will show up here.