Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Maze Ransomware Operators Step Up Their Game
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
5/11/2020 | 2:56:14 PM
The way this sounds, this was from an internal attack
Maze's initial ransom demands nearly $2.3 million, Kroll reports, citing Coveware data.

The first question is why didn't they just pay the ransomware after they identified the systems were being encrypted and the applications just stopped...After this Cognizant took the other systems offline and many of the company's clients suspended the access to Cognizant's networks.

Besides, the primary applications affected are VDI (Virtual Desktops) and WFH Laptops; that means that someone gained access to the laptop or VDI session, sent the Maze Ransomeware to a specific set of servers, ran the application across firewalls, IDS/IPS, and Antivirus/Malware tools and executed its payload to encrypt and stop services on Windows or Linux servers (some of which were hardened, some VDI environments are not as hardened as some might think).

There have been conversations that Cognizant is an Indian first organization where they bring in Americans to get the business then fire or lay them off to hire people from India (lower cost) to increase their bottom line. Sounds to me someone was pissed and partnered with the Maze group to offer their services, remember, they use equipment to check the lateral movement of certain actors, almost like this had a business model approach.

Are Maze operators behind the attack on the IT services giant ...

This is the screen that came from the attack.

IT Service Giant Cognizant Hit With MAZE Ransomware Attack

Again, I am not saying that things just happen, but I do believe that there is a thing called Karma when you treat people wrong, they oftentimes retaliate, I don't think this is just a fluke, the plot\ will continue to thicken (where is NSA or CyberSecurity Division when you need them).



COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-06-04
In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19861, CVE-2018-19862, and CVE-2019-17601. NOTE: this product is discontinued.
PUBLISHED: 2020-06-04
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service (loss of the ability to establish new connections), as demonstrated by SlowITe.
PUBLISHED: 2020-06-04
Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.
PUBLISHED: 2020-06-04
Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request ...
PUBLISHED: 2020-06-04
Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console� that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the applicat...