New Ransomware Tactic: Pay Us or the World Sees Your Keys

A new malware technique makes a company's files public if it refuses to pay ransom.

AccessTimeIconDec 20, 2019 at 4:55 p.m. UTC
Updated Sep 13, 2021 at 11:52 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

The creators of Maze Ransomware have added a new wrinkle to the typical hacker's MO. Instead of quietly infecting and requesting ransom from victims, the so-called Maze team is publicly exposing victims by displaying real files exfiltrated from their hacked servers.

This tactic could be a disaster for crypto companies that may have put private keys or other important financial data into their private archives, should they be breached.

"Represented here companies don't wish to cooperate with us, and trying to hide our successful attack on their resources. Wait for their databases and private papers here," write the hackers on their public website, mazenews.top. "Follow the news!"

Companies that have already been hit by the group include a grocery chain, Busch's Inc., in Ann Arbor, Mich., and a lawn and garden company, Massey Services, in Florida. We've reached out to the alleged Maze victims; many have already made public information about the hacks on their websites.

Another group, called REvil, promises to release for free or sell vital company information to competitors if its ransom is not paid. The hackers wrote:

Each attack includes a copy of private, commercial information. In case they refuse to pay, the data will either be sold to competitors or posted on open sources. We're interested in seeing how the GDPR [General Data Protection Regulation] authorities react. If they do not want to pay us they can pay 10 times more to the government. No problem.Translated by CoinDesk

“For years, ransomware developers and affiliates have been telling victims that they must pay the ransom or stolen data would be publicly released,” said Lawrence Abrams, ransomware researcher at BleepingComputer. “While it has been a well-known secret that ransomware actors snoop through victim’s data, and in many cases steal it before the data [are] encrypted, they never actually carried out their threats of releasing it.”

"This is especially ghastly news for companies that may already face steep fines and other penalties for failing to report breaches and safeguard their customers’ data. For example, healthcare providers are required to report ransomware incidents to the U.S. Department of Health and Human Services, which often documents breaches involving lost or stolen healthcare data on its own site," wrote security researcher Brian Krebs.

A list of invoices is one thing; publicizing the keys to a company's crypto accounts are another thing entirely. Given the amount of data involved, there's no telling what valuable information could be lurking amid a company's paperwork.

One victim was quick to publicly react to a Dec. 9 attack.

"As early as Tuesday morning [Dec. 10], we began bringing key business systems back online, prioritizing manufacturing and logistics functions that enable us to make and ship quality products to our customers," wrote Rich Stinson CEO of manufacturer SouthWire. "We are working diligently with our cybersecurity partner to understand the facts behind this event, resolve this disruption and resume normal business operations as quickly as possible."

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.