A well-known Russian hacking group previously sanctioned by the United States is behind the crippling ransomware attack on Sinclair Broadcast Group that is continuing to impact news stations across the country, according to The Hill citing a new report.
Bloomberg News cited multiple people “familiar with the attack” in reporting that a group known as Evil Corp. was behind the ransomware attack, which occurred late last week and was disclosed by Sinclair both to the Securities and Exchange Commission and to the public on Monday.
According to Bloomberg, the hackers used a malware virus known as Macaw to attack Sinclair. The company confirmed that data had been stolen in the attack, but that it was still working to determine exactly what data was stolen.
Sinclair noted Monday that the attack had caused “disruption” to portions of the company, including the provision of local advertisements, stressing that it was “working diligently to restore operations quickly and securely” and that it had engaged the help of an unnamed cybersecurity firm in doing so.
CNN reported Monday that some TV stations had trouble accessing graphics, phones and video files and that some live segments were being pre-taped.
Evil Corp. was the target of a multiagency effort in 2019 after it was accused of using its Dridex malware to steal more than $100 million from hundreds of banks and financial entities in over 40 countries.
As part of that effort, the Treasury Department issued sanctions against 17 individuals and and seven entities associated with Evil Corp., while the State Department offered a reward of up to $5 million for information that could help capture and convict the group’s leader, Maksim Yakubets. The Justice Department also unsealed an indictment against Yakubets.
The DarkSide group, also believed to be based in Russia, was linked to the ransomware attack on Colonial Pipeline in May that led to fuel shortages in several states, which also went offline following the incident.
No comments:
Post a Comment