Hackers Demand Millions from MSP After Infecting Networks with Ransomware

MSP Falls Victim to Ransomware, Infecting Thousands of Customer Networks

An unknown hacking group recently targeted a U.S. managed service provider (MSP) with ransomware.  This led to thousands of their customers getting infected with malicious software, totaling approximately 2,000 different networks.  After the ransomware executed, hackers demanded over $2 million to restore the encrypted files.  Whether or not these demands were negotiated and paid, remains unknown.

However, for this particular MSP, the damages could be catastrophic.  First, the ransom demands alone are incredibly high and likely improbable for an MSP to acquire.  Second, managed service providers are paid to provide a service for their customers — in this case, it was managing their cyber security.  If you, as a customer, pay for a service and that service isn’t provided, it’s entirely likely and justified, that the consumer is angry.  This anger could lead to finding alternative MSP services elsewhere.  Therefore, this attack is not only against the MSP’s consumer networks, but the MSP’s livelihood as well.  The damages, both financial and reputational, may prove to be detrimental.

Fears Becoming Reality

As it turns out, the fear of falling victim to a cyber attack is one that MSPs have been facing for some time.  However, there are ways to mitigate this risk.

The MSPs must be using security software that is focused on prevention.  This was not the case in this particular attack.  According to Dark Reading, this MSP was providing services that held heavy weight on detection and response.  Endpoint detection and response, or EDR, has become a major buzz word in the cyber security industry.  Unfortunately, when it comes to ransomware — EDR solutions provide rather limited remediation options.  The victim either pays the hacker in an attempt to decrypt their files, or they restore from backups.  Switching the emphasis to prevention is what MSPs must be doing, not only for themselves but for their customers as well.

This successful ransomware attack is a perfect example of EDR failing to provide adequate protection.  If this MSP was using an automated whitelist technology, this ransomware variant would have never been able to execute.  Why?  Because a whitelist will only allow for known, trusted programs to run.

To find a reseller or MSP near you that offers an automated, global whitelist approach to cyber security, click here.


 4,641 total views,  1 views today

(Visited 1 times, 1 visits today)

1 thought on “Hackers Demand Millions from MSP After Infecting Networks with Ransomware”

  1. The best possible result here, would be for the MSP to go bankrupt or out of business due to being unable to retrieve their data, and all the directors and office holders be sued into penury by class actions for negligence. Apparently, only when companies, government departments, et al, and all their highly paid officials are put out of business, and on social security, will they decide to take these threats seriously. The answers are out there, and they ignore them at their financial peril, not to mention their future career prospects.

    The response to this kind of problem by our governments is so absent, that one could be forgiven for thinking they actually condone it.

Leave a Comment

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.