Ransomware assaults showed no indication of slowing down in 2021 as enterprises ongoing to drop sufferer to facts theft and the pressured shutdown of operations.
Throughout the initial half of 2021, assaults struck significant infrastructure businesses and federal government agencies, triggering substantial fallout. Ransomware gangs targeted much larger businesses with more and more huge ransom needs.
Those developments ongoing, and no sector was still left unturned in the second half of 2021, like cryptocurrency exchanges. Extortion remained a crucial tactic for ransomware teams and in lots of scenarios, facts leak websites known as interest to assaults even in advance of companies disclosed the incidents. Attackers appeared to observe by means of on lots of of those people threats by exposing delicate documents.
Below are 10 of the major ransomware assaults for the second half of the 12 months as 2021 arrives to a near.
one. Kaseya
On July two, Kaseya experienced a supply chain attack when REvil operators hit the seller that presents distant administration software package for managed provider vendors (MSPs). In a statement to its internet site, Kaseya attributed the attack to the exploitation of zero-working day vulnerabilities in the on-premises model of its VSA merchandise. The flaws allowed attackers to bypass authentication and use VSA to remotely deliver arbitrary commands, major to the deployment of ransomware on MSPs’ customers. The broad character of the incident garnered the interest of the FBI, which issued an incident response manual.
As of July, Kaseya claimed it was “knowledgeable of fewer than 60 customers” impacted by the attack, but the fallout reached “one,five hundred downstream organizations.” In an incident update on July 22, Kaseya claimed it “received a universal decryptor crucial” from a third bash and that it was doing work to remediate impacted customers. It turned out the third bash was not REvil, as Kaseya confirmed it did not negotiate with the attackers and “in no unsure conditions” did not pay out a ransom to obtain the tool.
two. Accenture
World consulting organization Accenture confirmed it experienced a ransomware attack in August, nevertheless at the time the business claimed there was “no impression” on operations or on clients’ systems. LockBit operators claimed responsibility for the attack and established a countdown to leak the stolen facts to their public leak site if a ransom was not paid out. In the statement to SearchSecurity, Accenture claimed it “straight away contained the issue and isolated the afflicted servers” and fully restored afflicted systems from backups. Nonetheless, in an SEC submitting in October, Accenture disclosed that some customer systems were being breached, and attackers stole and leaked proprietary business facts.
three. Ferrara Candy Firm
This attack created the list for its unlucky timing, as the sweet corn maker was hit proper in advance of Halloween. Ferrara disclosed to media shops that it was hit by a ransomware attack on Oct. nine and was doing work with law enforcement in an investigation, as very well as with a complex group to “restore impacted systems.” Whilst efficiency was impacted, as of Oct. 22 function experienced resumed in “choose producing facilities” and transport operations were being pretty much again to usual, in accordance to the business. Ferrara did not disclose the style of ransomware or reveal if a ransom was paid out in get to resume operations.
four. Sinclair Broadcast Group
On October sixteen, an investigation into a possible stability incident from Sinclair Broadcast Group unveiled the media conglomerate experienced experienced a ransomware attack and facts breach. Subsequently, Sinclair contacted a cybersecurity forensic organization and notified law enforcement together with other federal government agencies. Whilst the style of ransomware, the extent of stolen facts and irrespective of whether a ransom was paid out remain unclear, the attack brought on disruptions to “specific workplace and operational networks.” That disruption involved some Sinclair-owned broadcast networks that skilled complex complications associated to the ransomware attack and were being temporarily unable to broadcast. As of a statement on October eighteen, Sinclair claimed it “can not determine” the attack’s “product impression on its enterprise, operations or money benefits.”
5. Eberspächer Group
A ransomware attack from the international automotive supplier brought on prolonged downtime at production crops and, in accordance to experiences, pressured paid out time off for the some of the manufacturing facility workforce. In a statement to its internet site, Eberspächer Group, which operates fifty crops, claimed it was the sufferer of a ransomware attack on Oct. 24 that impacted part of its IT infrastructure. Authorities were being contacted and precautionary actions were being taken to shut down all IT systems and disconnect the network. Updates posted to Twitter showed Eberspächer’s internet site was offline by means of Nov. 29, more than a person month later. Nonetheless, “most crops globally” were being delivering as of Nov. 5, when Eberspaecher tweeted that it was “on the proper observe.”
six. Nationwide Rifle Association
At the stop of October, experiences surfaced that the Nationwide Rifle Association (NRA) was the sufferer of a ransomware attack soon after Grief ransomware operators posted alleged private facts to its public leak site. Whilst the NRA did not validate the ransomware attack or situation a public statement, it did answer on Twitter. Andrew Arulanandam, managing director of NRA public affairs, claimed the “NRA does not focus on issues relating to its bodily or digital stability.” It truly is unclear what the ransom need was, or irrespective of whether the nonprofit business paid out it.
7. BTC-Alpha
In a statement to SearchSecurity, cryptocurrency platform BTC-Alpha confirmed it was the sufferer of a ransomware attack at the commencing of November, proper all around its 5-12 months anniversary. Whilst it appears no money were being impacted, the attack did get down BTC-Alpha’s internet site, as very well as its app, which remained out of fee by means of Nov. 20. At first, a screenshot posted to Twitter by risk intelligence organization DarkTracer sparked rumors of an attack from the cryptocurrency exchange. In accordance to the screenshot, LockBit claimed to have encrypted BTC-Alpha’s facts, a frequent tactic employed by ransomware gangs to force victims into paying out. BTC-Alpha founder and CEO Vitalii Bodnar has due to the fact attributed the attack to a competitor and claimed he “uncertainties the attack was associated to LockBit,” but could not share more information as the investigation was however underway.
[Notify] LockBit ransomware gang has declared “Cryptocurrency Exchange” on the sufferer list. pic.twitter.com/pA2bh1Vmte
— DarkTracer : DarkWeb Prison Intelligence (@darktracer_int)
November seventeen, 2021
eight. MediaMarkt
MediaMarkt created the list for equally its dimension — around one,000 digital retail stores in Europe and around fifty,000 employees — as very well as the substantial volume of the alleged need created in this ransomware attack. A report by Bleeping Laptop on Nov. eight claimed the need was $240 million and attributed it to the Hive ransomware team. Cybersecurity business Group-IB detailed Hive’s action and discovered the ransomware-as-a-provider team claimed hundreds of victims in just 6 months. In accordance to Group-IB, it took Hive less than half a 12 months to break the history for maximum ransom need. Whilst MediaMarkt confirmed to Bleeping Laptop that a cyber attack took position, it truly is unclear when the firm’s operations were being fully restored and irrespective of whether a ransom payment was created.
nine. Top-quality As well as
Pure gasoline supplier Top-quality As well as Corp. confirmed it was the sufferer of a ransomware attack that transpired on Dec. twelve. In a statement on Dec. fourteen, the Canada-primarily based corporation claimed it “temporarily disabled specific pc systems and purposes” in the wake of an investigation and “is in the procedure of bringing these systems again on the internet.” Independent cybersecurity industry experts were being hired to guide in the investigation. At the time of the statement, Top-quality As well as claimed it experienced “no evidence that the protection or stability of any purchaser or other particular facts experienced been compromised.” Top-quality As well as grew to become the most up-to-date energy business to put up with a ransomware assaults, following the significant-profile and disruptive attack on Colonial Pipeline Firm earlier this 12 months.
10. Kronos
On Dec. 11, Kronos Incorporated noticed unusual action in its personal cloud that involved encrypted servers. Two times later, the workforce administration company notified customers that it was the sufferer of a ransomware attack. In rather detailed updates furnished to its internet site, Kronos claimed in response it shut down more than “eighteen,000 bodily and virtual systems, reset passwords and disabled VPN site-to-site connections on the UKG aspect.” The incident impacted Kronos Non-public Cloud, Workforce Central, Telestaff, Healthcare Extensions and UKG scheduling and workforce administration for banks. 1 substantial concern was the ransomware attack’s impression on staff paychecks, due to the fact the HR systems company is commonly recognised for its payroll and time administration systems. Previous current on Monday, Kronos claimed “because of to the character of the incident, it might get up to quite a few months to fully restore system availability.”