Inside Information: Ransomware Targets Corporate Finance

The US Federal Bureau of Investigation (FBI) has released an advisory with a warning about how ransomware gangs are threatening to wipe out share prices for publicly held companies. 

Ransomware gangs infiltrate publicly owned companies by threatening financial exposure in an effort to promote ransom payments according to the warning.

The FBI says that ransomware criminals are likely using information on mergers, acquisitions and stock valuations to threaten vulnerable corporate targets.

The FBI says that cyber criminals try to find non-public information when targeting companies involved in major financial events, which they can threaten to publish if their ransom demand is not paid. “During the initial reconnaissance phase, cyber criminals identify non-publicly available information, which they threaten to release or use as leverage during the extortion to entice victims to comply with ransom demands... Impending events that could affect a victim’s stock value, such as announcements, mergers, and acquisitions, encourage ransomware actors to target a network or adjust their timeline for extortion where access is established,” the FBI says in the newly published advisory.

Ransomware Gangs Often Use Double Extortion Tactics To Threaten Victims

The new extortion tactic consists of cyber criminals targeting businesses when they are approaching significant and time-sensitive financial events, such as quarterly earnings reports or initial public offerings. The criminals attempt to increase the likelihood that the company will pay the ransom by threatening to leak stolen information relevant to the upcoming events if the victim fails to pay.

  • In addition to file encryption, sensitive data are stolen and a threat is issued to sell or publish the data if the ransom is not paid. Ransomware gangs conduct extensive research on their victims before launching an attack, which includes gathering publicly available data and nonpublic material. 
  • The attacks are then timed to coincide with the release of quarterly earnings reports, SEC filings, initial public offerings, and merger and acquisition activity, with the release of information having the potential to significantly affect the victim’s stock value.

In the alert, the Bureau said that activity over the course of the past year shows a trend toward targeting companies when they’re coming up to “significant, time-sensitive financial events,” such as quarterly earnings reports and mandated SEC filings, initial public offerings and M&A activity

Criminal organisations are starting to recognise the ability to drive leverage in their extortion demands by targeting companies at critical points. This creates a new twist to ransomware attacks and may make cyber criminals more successful in obtaining payouts. 

The targeting of information specifically damaging to share price isn’t the only emerging ransomware trend. Recently, the FBI said that the 'Hello Kitty' group of cyber criminals  has added the threat of distributed denial of service (DDoS) attacks to its mix of “persuasion” tactics. The 'Hello Kitty' actors aggressively apply pressure to victims typically using the double extortion technique,” the FBI warned, referring to the double-whammy of encrypting files and exfiltrating information to make public if ransoms aren’t paid.  "In some cases, if the victim does not respond quickly or does not pay the ransom, the threat actors will launch a DDoS attack on the victim company’s public-facing website.”

Hello Kitty typically tailors its ransom demands to targets, and is known for using compromised credentials or known vulnerabilities in security software like SonicWall products for initial access to corporate networks. Last year, a ransomware actor called 'Unknown' appeared to be the first to use the approach, boasting on a Russian hacking forum that a good way to sway targets to pay up ransom demands is by referencing their corporate presence on the NASDAQ stock exchange.

The FBI advises against paying  ransom to criminals as thet consider this will only encourage them to target other victims. 

The FBI advisory reports that between March and July 2020, "at least three publicly traded US companies actively involved in mergers and acquisitions were victims of ransomware during their respective negotiations." According to the FBI, out of the three companies, only one of the negotiations was public knowledge. 

Paying the ransom does not guarantee a victim’s files will be recovered, although the FBI says that it understands when businesses are faced with an inability to function, corporate leaders will take all options into account to protect their shareholders and customers interests.

The FBI urges victims to report ransomware incidents and to provide law enforcement investigators with the critical information they need to track ransomware attackers, to hold them legally accountable and prevent future attacks. 

FBI:    Oodaloop:   Threatpost:   Techtarget:    ITSecurity Wire:     HIPPA:      Techcrunch:     

You Might Also Read: 

Directors Must Understand Their Organisation’s Cyber Risks: (£)

 

« The Value Of Network Pen Testing To Reduce Cyber Attacks
REvil Ransomware Gang Leaders Arrested in Poland »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Advent IM

Advent IM

Advent IM is one of the UK’s leading independent cyber security specialists, with a unique approach to providing holistic security management solutions.

DataCore Software

DataCore Software

DataCore Software is a leader in Software-Defined Storage. Solutions offered include back up and disaster recovery.

Genie Networks

Genie Networks

Genie Networks is a leading technology company providing networking and security solutions for optimizing the performance of large networks.

Managed Security Solutions (MSS)

Managed Security Solutions (MSS)

MSS deliver consultancy services and managed security services for IT departments who may lack the time, resources, or expertise themselves.

Radiflow

Radiflow

Radiflow is a leading provider of cyber security solutions for critical infrastructure networks (i.e. SCADA), such as power utilities, oil & gas, water and others.

Rule4

Rule4

Rule4 is a global professional services firm that provides practical, real-world knowledge and solutions in areas including cybersecurity, AI, Machine Learning and industrial control systems.

Blockchain R&D Hub

Blockchain R&D Hub

Blockchain R&D Hub's mission is to serve the needs of blockchain ecosystem as the center of excellence for technology research and development.

Curricula

Curricula

Curricula's cyber security awareness training delivers short relatable security stories to your employees. We make learning cyber security simple and fun.

Bradley-Morris

Bradley-Morris

Bradley-Morris is a leading recruiting firm specializing in transitioning military and veteran talent into civilian careers including Cybersecurity.

Verificient Technologies

Verificient Technologies

Verificient Technologies specializes in biometrics, computer vision, and machine learning to deliver world-class solutions in continuous identity verification and remote monitoring.

Cyber Intelligence 4U

Cyber Intelligence 4U

Cyber Intelligence 4U is an educational services company that provides two levels of cybersecurity training programs: executive and technical.

Sentinel

Sentinel

Sentinel works with governments, media and defence agencies to help protect democracies from disinformation campaigns by developing a state-of-the-art AI detection platform.

CerraCap Ventures

CerraCap Ventures

CerraCap Ventures invest globally into early-stage B2B companies in Healthcare, Enterprise AI and Cyber Security.

Binalyze

Binalyze

Binalyze is the world's fastest and most comprehensive enterprise forensics solution. Our software helps you to collaborate and complete incident response investigations quickly.

ThreatNG Security

ThreatNG Security

ThreatNG is redefining external attack surface management (EASM) and digital risk protection with a platform of unmatched breadth, depth, and capabilities in thwarting technical and business threats.

Quantum Ventura

Quantum Ventura

Quantum Ventura is a technology innovation company with a single mission of delivering customer-centric advanced solutions to US Federal & State Governments and Private Sector customers.