Intrusion Activity: Hackers Destroyed VFEmail Service

On February 11, hackers destroyed all U.S. infrastructure for the U.S.-based secure email provider VFEmail.net. The company detected the attack on the 11th and reported several updates as it identified the extent of the damage. The attack destroyed all data and backup files for all users, and the founder of VFEmail has stated the company will likely not return. VFEmail stated there was no ransom note, suggesting this was a targeted attack intended primarily to destroy the company and not for financial gain.

Recommendations

For those who are not users of VFEmail, there are no necessary steps at this time. Users of VFEmail should

• Take steps to set up an alternate email provider;
• Monitor updates from VFEmail; and
• Because current reporting suggests no data will be recovered, take all possible steps to recover and replicate data lost in this attack.

This incident also highlights the value that offline backups provide an enterprise. VFEmail did routine backups; however, because they were always connected to the network, the hackers were able to destroy those files in addition to the production servers. For company critical information, we recommend:

• Using a backup service that stores that data offline; and
• Enabling the cyber attack chatter rule in the ZeroFOX platform to monitor for information indicating targeting of your enterprise.

Details

On February 11, the VFEmail team noticed that all of its servers went offline with no notice. Subsequently, the company identified the hackers formatting its backup server and confirmed that all disks on all servers had been wiped, destroying all data and backups. VFEmail has provided limited details so far about the intrusion, including the username aktv and the IP address 94[.]155[.]49[.]9, registered in Bulgaria. It has also stated that the hackers were able to access multiple virtual machines with different authentications, suggesting this attack was methodical and targeted. The founder of VFEmail believes the intruders had multiple means of access to their infrastructure and thus no security steps would have protected them from the attack.

Updates from VFEmail indicate the company is delivering mail again for at least some users. The company has retained a data recovery vendor to assist with its recovery efforts.