Olympus likely victim of BlackMatter ransomware

The European operations of Japanese optical expertise big Olympus stay offline at this time, following an obvious ransomware attack, thought likely to be the work of the BlackMatter syndicate.

Although on the time of writing Olympus had disclosed solely that it was investigating a cyber safety incident, sources with insider data of the incident, which occurred on Wednesday 8 September, told TechCrunch {that a} ransom word left on contaminated PCs indicated an assault by BlackMatter – the veracity of the word was confirmed by ransomware consultants.

In a quick assertion, the corporate mentioned: “Upon detection of suspicious exercise, we instantly mobilised a specialised response staff together with forensics consultants, and we’re at present working with the best precedence to resolve this challenge. As half of the investigation, we’ve got suspended knowledge transfers within the affected programs and have knowledgeable the related exterior companions.

“We are currently working to determine the extent of the issue and will continue to provide updates as new information becomes available. We apologise for any inconvenience this has caused.”

The BlackMatter group first emerged in the course of the summer time of 2021, and was instantly linked by analysts and researchers to the now defunct DarkSide crew behind the Colonial Pipeline assault in May.

The group subsequently claimed that it had labored with DarkSide previously, however that they don’t seem to be one and the identical. Research by Sophos analysts suggests it is usually influenced by REvil – the destiny and standing of which stays considerably unsure.

Like many different ransomware gangs, it operates a ransomware-as-a-service (RaaS) operation, and brazenly seeks out preliminary entry brokers (IABs) who may help it penetrate company networks – up to now it has focused enterprises with annual gross sales of over $100m.

It can also be specific about not attacking organisations equivalent to hospitals or essential nationwide infrastructure (CNI) operators, though like every claims made by a ransomware gang, this must be taken with a hefty pinch of salt.

CybSafe CEO and founder Oz Alashe commented: “The rising recognition of ransomware-as-a-service means it’s by no means been simpler for criminals to hold out a cyber assault, even on tech giants.

“The practice ​​opens possibilities for those who want to commit ransomware attacks but previously did not have the technical capabilities or know-how to execute it. This auctioning off of services from groups such as BlackMatter increases the scope of threat, and also the number of potential targets.”

Anthony Gilbert, cyber risk intelligence lead at Bridewell Consulting, a safety providers supplier, added: “Olympus will probably be nonetheless working by way of its incident response and digital forensics course of to grasp what was compromised and the way. But the actual fact the enterprise has needed to shut down pc networks is regarding as each minute the enterprise shouldn’t be working will influence each income and fame.

“It’s not clear at this stage if the company has, or is going to pay the ransom, and this will largely depend on the company’s response process and interests of the organisation and its customers,” he mentioned.

“The problem is, paying the ransom does not guarantee files will be successfully decrypted, nor prevent a second similar incident or doxxing blackmail to which the organisation may remain vulnerable.”