The BlackSuit ransomware gang is claiming responsibility for a June 8th cyberattack on Kadokawa Corporation, threatening to publish stolen data unless a ransom is paid. The gang has set a deadline of July 1st for the ransom, warning that the released data will include contacts, confidential documents, employee data, business plans, and financial data.
Kadokawa Corporation is a major Japanese media conglomerate involved in film, publishing, and gaming, including the well-known game developer FromSoftware. The company reported net sales of approximately $1.6 Billion USD in 2023. The cyberattack caused service outages across multiple Kadokawa Group websites, significantly disrupting the company’s operations as they share the same data center. This attack particularly affected the popular Japanese video-sharing platform Niconico.
“In response to the system failure, Kadokawa is working on building a secure network and server environment,” explained the Wednesday update.
“Its top priority is to restore the accounting functions, which are fundamental to its business activities, and to normalize the manufacturing and distribution functions in the publication business, which generate considerable revenue. The accounting functions, owing partly to measures in an analog manner, are expected to be restored in early July.”
BullWall Executive, Carol Volk had this comment:
“As Kadokawa rebuilds its systems, focusing on the protective aspects of ransomware containment is crucial. A robust ransomware containment system offers significant benefits over simple Endpoint Detection and Response (EDR) solutions. While EDR is essential for identifying and mitigating threats, a comprehensive ransomware containment system ensures that sensitive data remains secure even during an attack. This approach not only detects but also isolates and neutralizes threats”
Cigent CGO Brett Hansen follows with this comment:
“Restoring critical functions and rebuilding the network is table stakes after a major attack and fortifying against similar threats. That said, it is more a matter of protection, than detection to ensure data remains safe during an attack. When data is protected at rest, it can remain safe during an attack. There are multiple ways to ensure an attacker in-system still cannot steal or encrypt your data. zero-trust, MFA, hidden partitions and encryption are all proven methods of protecting data at rest when properly implemented.”
I wish the company luck in restoring their systems. But in this day and age, you need a plan to keep the bad guys out, and a plan to fix everything if they do get in. I am not sure about the first part of this, but this organization is certainly testing the second part right now.
“Clusterbomb” Malware droppers hit over 50,000 victims
Posted in Commentary with tags Outpost24 on June 28, 2024 by itnerdSecurity researchers discovered a threat actor known as Unfurling Hemlock infecting target systems with up to ten pieces of malware simultaneously. Dubbed a “malware cluster bomb” by researchers, this method involves using one malware sample to spread additional ones on compromised machines. The malware mainly consisted of stealers, such as Redline, RisePro and Mystic Stealer, and loaders such as Amadey and SmokeLoader.
Outpost24’s KrakenLabs, the Cyber Threat Intelligence team, discovered this operation. Their findings reveal that Unfurling Hemlock’s activity dates back to at least February 2023 and employs a unique distribution method. KrakenLabs has identified over 50,000 “cluster bomb” files with distinct characteristics linking them to Unfurling Hemlock.
The attack begins with the execution of a file named ‘WEXTRACT.EXE’, which arrives on target devices through malicious emails or malware loaders that Unfurling Hemlock acquires from other operators. This executable contains nested compressed cabinet files, each level holding a malware sample and another compressed file. As each stage is unpacked, a new malware variant is dropped onto the victim’s machine. The final stage’s extracted files are executed in reverse order, with the most recently extracted malware executed first.
The researchers found that over half of Unfurling Hemlock’s attacks targeted systems in the United States, with significant activity also observed in Germany, Russia, Turkey, India, and Canada.
Evan Dornbush, former NSA cybersecurity expert had this to say:
“KrakenLabs’ report demonstrates why it is critical to support cybersecurity research efforts. The attackers appear to have taken a multitude of known tools and packaged them up in a novel mechanism that could facilitate evasion from defensive technology or, if detected, only be partially caught and removed from infected systems. In other words, things the defensive community thought were “solved” are still able to have harmful impact. This report highlights how both attackers and defenders incrementally improve looking at prior works.”
Organizations and perhaps individuals have one more thing that they can add to the list of things that they need to create defences to stop. Making life hard for overworked teams who are responsible for stopping cyber threats.
Leave a comment »