A ransomware attack paralyzed the networks of at least 200 US companies on Friday, said a cybersecurity researcher whose company was responding to the incident.
The REvil gang, a major Russian-speaking ransomware syndicate, appears to be behind the attack, said John Hammond of the security firm Huntress Labs Inc.
He said the criminals targeted a software supplier called Kaseya, using its network management package as a conduit to spread the ransomware through cloud service providers.
Other researchers agreed with Hammond’s assessment.
“Kaseya handles large enterprise all the way to small businesses globally, so ultimately, [this] has the potential to spread to any size or scale business,” Hammond said in a direct message on Twitter. “This is a colossal and devastating supply chain attack.”
Such cyberattacks typically infiltrate widely used software and spread malware as it automatically updates.
It was not immediately clear how many Kaseya customers might be affected or who they might be.
Kaseya urged customers in a statement on its Web site to immediately shut down servers running the affected software.
It said the attack was limited to a “small number” of its customers.
Brett Callow, a ransomware expert at cybersecurity firm Emsisoft Ltd, said he was unaware of any previous ransomware supply-chain attack on this scale.
There have been others, but they were fairly minor, he said.
“This is SolarWinds with ransomware,” he said.
He was referring to a Russian cyberespionage hacking campaign discovered in December last year that spread by infecting network management software to infiltrate US federal agencies and scores of companies.
Cybersecurity researcher Jake Williams, president of Rendition Infosec, said he was already working with six companies hit by the ransomware.
It is no accident that this happened before the US national holiday Fourth of July weekend, when IT staffing is generally thin, he added.
“There’s zero doubt in my mind that the timing here was intentional,” he said.
Hammond said he was aware of four managed-services providers — companies that host IT infrastructure for multiple customers — being hit by the ransomware, which encrypts networks until the victims pay off attackers.
He said thousand of computers were hit.
“We currently have three Huntress partners who are impacted with roughly 200 businesses that have been encrypted,” Hammond said.
Hammond wrote on Twitter: “Based on everything we are seeing right now, we strongly believe this [is] REvil/Sodinikibi.”
The FBI linked the same ransomware provider to a May attack on JBS SA, a major global meat processor.
The White House and the US Cybersecurity and Infrastructure Security Agency did not immediately return messages seeking comment.
MORE VISITORS: The Tourism Administration said that it is seeing positive prospects in its efforts to expand the tourism market in North America and Europe Taiwan has been ranked as the cheapest place in the world to travel to this year, based on a list recommended by NerdWallet. The San Francisco-based personal finance company said that Taiwan topped the list of 16 nations it chose for budget travelers because US tourists do not need visas and travelers can easily have a good meal for less than US$10. A bus ride in Taipei costs just under US$0.50, while subway rides start at US$0.60, the firm said, adding that public transportation in Taiwan is easy to navigate. The firm also called Taiwan a “food lover’s paradise,” citing inexpensive breakfast stalls
TRADE: A mandatory declaration of origin for manufactured goods bound for the US is to take effect on May 7 to block China from exploiting Taiwan’s trade channels All products manufactured in Taiwan and exported to the US must include a signed declaration of origin starting on May 7, the Bureau of Foreign Trade announced yesterday. US President Donald Trump on April 2 imposed a 32 percent tariff on imports from Taiwan, but one week later announced a 90-day pause on its implementation. However, a universal 10 percent tariff was immediately applied to most imports from around the world. On April 12, the Trump administration further exempted computers, smartphones and semiconductors from the new tariffs. In response, President William Lai’s (賴清德) administration has introduced a series of countermeasures to support affected
CROSS-STRAIT: The vast majority of Taiwanese support maintaining the ‘status quo,’ while concern is rising about Beijing’s influence operations More than eight out of 10 Taiwanese reject Beijing’s “one country, two systems” framework for cross-strait relations, according to a survey released by the Mainland Affairs Council (MAC) on Thursday. The MAC’s latest quarterly survey found that 84.4 percent of respondents opposed Beijing’s “one country, two systems” formula for handling cross-strait relations — a figure consistent with past polling. Over the past three years, opposition to the framework has remained high, ranging from a low of 83.6 percent in April 2023 to a peak of 89.6 percent in April last year. In the most recent poll, 82.5 percent also rejected China’s
PLUGGING HOLES: The amendments would bring the legislation in line with systems found in other countries such as Japan and the US, Legislator Chen Kuan-ting said Democratic Progressive Party (DPP) Legislator Chen Kuan-ting (陳冠廷) has proposed amending national security legislation amid a spate of espionage cases. Potential gaps in security vetting procedures for personnel with access to sensitive information prompted him to propose the amendments, which would introduce changes to Article 14 of the Classified National Security Information Protection Act (國家機密保護法), Chen said yesterday. The proposal, which aims to enhance interagency vetting procedures and reduce the risk of classified information leaks, would establish a comprehensive security clearance system in Taiwan, he said. The amendment would require character and loyalty checks for civil servants and intelligence personnel prior to
RSS