Ransomware Victim Disclosures : Maze, NEFILIM compromise new victims

The Maze, NEFILIM, and EVILEAKS ransomware groups have been busy over the last week, compromising a laundry list of new victims. Victims include organizations across a variety of verticals, including banking and financial services, healthcare, and communications.

Recommendations

Consider enabling additional ZeroFOX dark web coverage to identify mentions or discussion of targeting of your brand on the dark web
If you are interested in further insight, reach out to [email protected] for assistance

Details

Maze group infects new organizations across a variety of verticals

Initially observed in May 2019, the Maze ransomware is known for notable, high-profile attacks. Maze is a particularly sophisticated strain of Windows ransomware that encrypts files and makes them inaccessible while adding a custom extension containing part of the ID of the victim. Actors are known to exfiltrate data from the network for further extortion. Maze spreads mainly using email spam and various exploit kits, notably Spelevo and Fallout. The Maze group utilizes a public website to name and shame victims who do not pay ransom demands.

On April 30, 2020, the Maze group posted a new disclosure, claiming to have infected Banco BCR Bank. Banco BCR is a state-owned commercial bank that operates in Costa Rica. It is one of the largest banks in both Costa Rica and Central America. The hackers claim to have initially gained access to Banco BCR's network in August 2019. After the bank failed to secure the network, the hackers once again gained access to the bank's network in February 2020. They claim 11 million credit card credentials were stolen. Of these credit cards, 4 million are stated to be unique and 140,000 allegedly belong to people from the USA.

Other recent Maze targets include a domain owned by an American plastic surgeon ( kristintarbetmd[.]com), US-based chemical company PeroxyChem, global communications company ClearOne, regional ISP Dakota Carrier, American CPA Dakota & Morgan, and Colorado-based consulting company Homestead Management Corporation.

MAS Holdings targeted by NEFILIM

On April 27, 2020, sensitive data belonging to MAS Holdings, a major South Asian apparel manufacturer, was leaked by the operators of NEFILIM ransomware. MAS Holdings is one of South Asia’s largest apparel manufacturers, and has 53 manufacturing facilities in 17 countries, employing over 93,000 people globally. The hackers claim to have downloaded 300 gb of their private files from the breached organization’s network.

NEFILIM ransomware surfaced and began spreading at the end of February 2020. The ransomware encrypts files with AES-128 encryption and appends ".NEFILIM" to infected files. The malware shares code with the Nemty ransomware family but instead of using a Tor payment site, the malicious software relies on email communication for payment. The threat actor behind NEFILIM threatens to release stolen data if the ransom is not paid within seven days.

Brazlian National Supplementary Health Agency Shamed on EVILEAKS

On May 1, 2020, the threat actor, Razor, posted about 61GB of data belonging to Brazil’s National Supplementary Health Agency on EVILEAKS shaming website. Brazil’s National Supplementary Health Agency (ANS) was founded in 2000 by the ministry of health. The ANS monitors trends in private plan costs, providers, and inputs, authorizes corporate splits, mergers, acquisitions, transfer of shares, and articulates with consumer protection organizations. The ANS website (ans[.]gov[.]br) is currently down.

Conclusion

Ransomware operators continue to target organizations with the goal of extorting demands from victims in exchange for decrypting valuable data. Many ransomware operators have resorted to shaming their victims by leaking their information from the files stolen during the attack if the ransom is not paid. This tactic is likely an attempt to increase the likelihood that a compromised organization concedes to ransom demands.