Ransomware Group Tries and Fails to Extort Security Vendor Dragos

A cybercrime team that managed to compromise the cloud-based means of a cybersecurity vendor tried out to extort the corporation by threatening loved ones associates, the corporation has discovered.

Operational technology (OT) security specialist Dragos reported it was strike on May perhaps 8 after menace actors compromised the email account of a new revenue personnel prior to their begin date.

Browse additional on ransomware: Time Taken to Deploy Ransomware Drops 94%.

They subsequently made use of the employee’s individual data to impersonate them and finish some primary onboarding, according to the vendor’s report on the incident. This received them as significantly as entry to the company SharePoint account and contract management technique, but no further more.

Nonetheless, after failing to deploy a ransomware payload or steal much more delicate information and facts, the group seemingly resorted to seeking to extort Dragos executives to stay away from public disclosure.

Whilst no Dragos get in touch with responded, the group repeatedly tried out to up the stress, getting in contact with multiple publicly identified Dragos workforce and attempting to use understanding of loved ones associates to force a reaction.

“The cyber-criminals’ texts shown investigation into family members aspects as they understood names of household users of Dragos executives, which is a regarded TTP. Even so, they referenced fictitious email addresses for these spouse and children users,” the report noted.

“In addition, all through this time, the cyber-criminals contacted senior Dragos workers by using particular email. Our choice was that the finest response was to not engage with the criminals.”

Dragos co-founder and CEO, Robert Lee, shared much more information by means of Twitter.

“The criminals clearly grew discouraged simply because we under no circumstances tried to contact them,” he tweeted. “Paying was under no circumstances an selection. They continued to contact me, threaten my family members, and the relatives of quite a few of our workforce by their names.”

In the finish, the vendor’s multi-layered security tactic seems to have prevented a far more serious compromise.

The risk actors could not obtain the Dragos messaging technique as they necessary admin approval and were unable to compromise the IT helpdesk, purchaser assistance info, the worker recognition procedure, income prospects and much more, because of to purpose-centered accessibility controls.

Once the hackers were being identified by using the vendor’s security data and celebration administration (SIEM) resource, it blocked the compromised account and activated 3rd-party incident response and MDR. Security controls prevented any malicious actor lateral motion, privilege escalation, persistent obtain or variations to the firm’s infrastructure, Dragos stated.

Sad to say, not all ransomware victims have a related practical experience. Sophos claimed in a report yesterday that 66% of businesses fell target to ransomware in 2022, and a substantial 76% of them experienced details encrypted.

Some sections of this write-up are sourced from:
www.infosecurity-magazine.com