News is filtering out that NVIDIA who makes graphics chips for major PC companies among other things has been hit by a major cyberattack. The word on the street says that their business may have been partially or completely compromised as a result:
NVIDIA has seemingly been hit by a major cyberattack that may have completely compromised parts of its business, reports The Telegraph. In their exclusive report, The Telegraph reports that the cyberattack was initiated at the same time as the Russian cyber warfare division started their offensive against Ukraine. All Nato allies have announced major sanctions on Russia and this could potentially be why Russia has decided to target major companies such as NVIDIA.
The report further states that the cyberattack on NVIDIA has completely compromised parts of their business and there are already reports from several users coming in regarding services disruption. The scale of this attack is currently unknown but it clearly seems to be a major one as NVIDIA had to take several systems offline to pacify the intrusion before it could spread further: “‘The ultimate concern is that somebody may have put something in one of the software updates,’ Dr Woodward said, pointing to the devastating SolarWinds hack that exploited American software companies to gain access to US government computer systems. ‘They’ll be going through trying to make sure to see if there’s any indication that anything has been changed in their software that they then shipped to their clients.'” NVIDIA’s mail servers were also partially operational during this time so it’s entirely likely that there might have been a breach in confidential documents. But it is not confirmed yet if any data was stolen.
This is far from trivial. If the threat actors, which at this point appears to be Russia, slipped something into software updates such as graphic card driver updates, then this could become a massive supply chain attack that could affect tens of thousands of users. If the threat actors stole anything, that could really hurt NVIDIA’s business in the long term.
My question is, will this prompt retaliation from the US and other allies? We’ll have to watch and see.
NVIDIA Strikes Back At The Hackers Who Hacked Them
Posted in Commentary with tags Hacked, NVIDIA on March 1, 2022 by itnerdAccording to Vx-underground on Twitter, NVIDIA, which was the victim of an epic cyberattack last week, has reportedly retaliated against the hacker group that attacked them by hacking them:
The interesting part of the incident is that the group has reportedly made a copy of the stolen data on a virtual-machine environment, which implies that this counter-attack was not be successful. But it’s interesting that NVIDIA decided to go this route as opposed to engaging law enforcement.
LAPSU$ made the news recently for pwning a TV network in Portugal. They’re apparently based in South America and is well known in the ransomware community. And clearly this ransomware group takes steps to protect themselves that companies should be taking to avoid getting pwned. Such as making backups.
Mark my words. This is not over. There’s going to be more coming from this story.
UPDATE: Here’s some more info. NVIDIA has spoken. While they haven’t commented on attacking LAPSU$, they did say that the attack leaked employee credentials and some company proprietary information online after their systems were breached.
“We have no evidence of ransomware being deployed on the Nvidia environment or that this is related to the Russia-Ukraine conflict,” the company’s spokesperson said in a statement. The Santa Clara, California-based company said it became aware of the breach on Feb. 23. Nvidia added it was working to analyze the information that has been leaked and does not anticipate any disruption to the company’s business. A ransomware outfit under the name “Lapsus$” has reportedly claimed to be responsible for the leak and seemingly has information about the schematics, drivers and firmware, among other data, about the graphics chips.
UPDATE #2: Dr. Saumitra Das, CTO and Co-Founder, Blue Hexagon had this to say:
“This is typical of ransomware gangs nowadays where they can still cause brand damage and steal IP without actually deploying the final ransomware payloads. Double and triple extortion are all part of the current playbook for these attackers. In this case, it appears that the group claims to have been able to steal IP without encrypting data. There is always a tradeoff for the attackers between encrypting data and stealing data because encryption and deletion can trigger alarms at organizations with mature security programs and take away the leverage from the attackers.”
Leave a comment »