San Francisco 49ers Hit by Ransomware

Cyber-criminals have attacked the San Francisco 49ers American soccer workforce with ransomware.

The National Soccer League (NFL) team, whose mascot is a gold miner named Sourdough Sam, confirmedthe attack a single working day just before Sunday’s Super Bowl that saw the Los Angeles Rams protected a victory at dwelling in the remaining minutes of a close-operate activity. 

Affirmation of the attack arrived immediately after the 49ers were listed on a dark web leak site as a target of ransomware-as-a-services (RaaS), BlackByte. The attack could have been carried out by the creators of the ransomware of by an affiliate accessing the malware in return for a share of any illegal proceeds attained by way of its use.

“BlackBytes is a RaaS that launched in the center of past yr and, like many other ransomware households, it can be coded to stay away from encrypting systems that use the languages of Russia or other publish-Soviet international locations,” saidEmsisoft threat analyst Brett Callow. 

Cyber-criminals assert to have stolen some of the San Francisco team’s economical knowledge which include invoices from 2020. With an estimated value of $4.175B, the 49ers are the sixth most valuable group in the NFL. 

The 49ers stated in a statement that it had experienced a “network security incident” that had quickly disrupted its corporate network. 

“To day, we have no indicator that this incident includes methods exterior of our corporate network, these as these related to Levi’s Stadium operations or ticket holders,” said the workforce. 

Information of the attack on the 49ers adopted the issuance of a joint security advisory on BlackByte ransomware by the FBI and Mystery Company on February 11.

“As of November 2021, BlackByte ransomware had compromised numerous US and overseas enterprises, together with entities in at minimum 3 US critical infrastructure sectors (government facilities, financial, and meals & agriculture). BlackByte is a Ransomware as a Service (RaaS) team that encrypts files on compromised Windows host programs, like actual physical and digital servers,” warned the advisory.

Matthew Warner, CTO and co-founder at Blumira, stated that like Conti ransomware, BlackByte experienced been identified using trade vulnerabilities such as ProxyShell to obtain a foothold in environments. 

“BlackByte utilizes perfectly-established ways these as Powershell exploitation of obfuscated base64 material to accomplish all encryption on hosts after exploited,” commented Warner. 

Some pieces of this posting are sourced from:
www.infosecurity-journal.com