Cyber-wellness Means Cyber-awareRead more Addressing maternal mental healthcare in AfricaRead more Qatar v. Ecuador to kick off FIFA World Cup 2022™ on 20 NovemberRead more Webb Fontaine Announces Launch of Niger National Single Window (NNSW) to Bolster TradeRead more Ethiopia: Loan from United Nations Fund Allows Food and Agriculture Organization (FAO) to Scale Up Fertilizers for Farmers in TigrayRead more How Choosing the Right Printer Helps Small Businesses and Content Creators to Save Time, Maximise Productivity and Achieve GrowthRead more Eritrea: World Breastfeeding WeekRead more Eritrean community festival in Scandinavian countriesRead more IOM: Uptick in Migrants Heading Home as World Rebounds from COVID-19Read more Network International & Infobip to offer WhatsApp for Business Banking Services to Financial Institution Clients across AfricaRead more

Hackers demand $70 mn after Kaseya ransomware attack

show caption
Sweden's Coop supermarket chain was among the most high-profile victims./AFP
Print Friendly and PDF

Jul 06, 2021 - 04:23 AM

PARIS, FRANCE — Hackers were on Monday demanding $70 million in bitcoin in exchange for data stolen during a “gargantuan” attack on a US IT company that has shuttered hundreds of Swedish supermarkets.

Researchers believe more than 1,000 companies could have been affected by the attack on Miami-based firm Kaseya, which provides IT services to some 40,000 businesses around the world.

The FBI warned Sunday that the scale of the “ransomware” attack — a form of digital hostage-taking where hackers encrypt victims’ data and then demand money for restored access — is so large that it may be “unable to respond to each victim individually”.

“It’s probably the biggest ransomware attack of all time,” said Ciaran Martin, cybersecurity professor at the University of Oxford.

“Because of the nature of the attack there’s still a lot of uncertainty over its impact,” he stressed.

But he added that because this was a “supply chain attack” — targeting a company serving thousands of firms, many of whom in turn provide IT support to smaller businesses such as car dealerships — the total number of victims was potentially huge.

Sweden’s Coop supermarket chain was among the indirect victims, with its cash registers paralysed since Friday when its IT subcontractor Visma Esscom was hit by the attack.

Most of Coop’s 800 stores were still closed Monday, spokesman Kevin Bell told AFP, with the few hundred that have reopened relying on alternative payment solutions such as customers paying using their smartphones.

Cybersecurity firm ESET said it had identified victims of the hack in at least 17 countries, from South Africa to Britain to Mexico. New Zealand’s education ministry said at least two schools there had been affected.

REvil hackers suspected 

Experts believe the attack was probably carried out by REvil, a Russian-speaking hacking group known as a prolific perpetrator of ransomware attacks.

A post on Happy Blog, a site on the dark web previously associated with the group, claimed responsibility for the attack and said it had infected “more than a million systems” — which if true would make this attack “absolutely gargantuan in scale”, according to Martin.

The FBI believes that REvil, which also goes by the name Sodinokibi, was behind a ransomware attack last month on global meat-processing giant JBS. The Brazil-based company ended up paying $11 million in bitcoin to the hackers.

The hackers’ blog post said they would release a decryption tool online “so everyone will be able to recover from attack in less than an hour” — if they were handed $70 million in bitcoin.

The hackers have also been reaching out to individual victims and demanding smaller ransoms, Martin said.

“As far as I understand it, they’ve been issuing demands that are about $50,000 for smaller organisations, rising to $5 million for larger organisations,” he told AFP. “We don’t know who’s paid.”

Kaseya said Sunday it believed the damage had been restricted to a “very small number” of customers using its signature VSA software, which lets companies manage networks of computers and printers from a single point.

But cybersecurity firm Huntress Labs said in a Reddit forum that it was working with partners targeted in the attack, and that the software was manipulated “to encrypt more than 1,000 companies”.

Kaseya said it had “immediately shut down” its servers after detecting the attack on Friday and warned its VSA customers to do the same, “to prevent them from being compromised”.

The company has released a tool allowing its customers to find out whether their own computer systems have been compromised by the attack.

‘State-tolerated’ hacking 

In recent months numerous US companies, including the computer group SolarWinds and the Colonial oil pipeline, have been the victims of high-profile ransomware attacks, which the FBI blames on hackers based in Russia.

While Washington officials do not accuse the Russian government of direct involvement in such attacks, they say the country is harbouring hackers who should be arrested.

US President Joe Biden raised the threat in talks with Russian counterpart Vladimir Putin last month, and on Saturday ordered a full investigation into the Kaseya attack.

“”Most experts would take the view that it’s highly unlikely that it’s state-directed,” Martin said of this latest cyber-assault. “It’s state-tolerated.”

  • bio
  • twitter
  • facebook
  • latest posts

LMBCBUSINESS.COM uses both Facebook and Disqus comment systems to make it easier for you to contribute. We encourage all readers to share their views on our articles and blog posts. All comments should be relevant to the topic. By posting, you agree to our Privacy Policy. We are committed to maintaining a lively but civil forum for discussion, so we ask you to avoid personal attacks, name-calling, foul language or other inappropriate behavior. Please keep your comments relevant and respectful. By leaving the ‘Post to Facebook’ box selected – when using Facebook comment system – your comment will be published to your Facebook profile in addition to the space below. If you encounter a comment that is abusive, click the “X” in the upper right corner of the Facebook comment box to report spam or abuse. You can also email us.