Major Argentine Telecom Falls Victim to $7.5M Monero Ransomware Attack
Argentina’s largest telecommunications company has fallen victim to a $7.5M ransomware attack.
Telecom, Argentina’s largest telecommunications company, has fallen victim to a ransomware attack. Hackers are demanding $7.5 million in Monero (XMR) â€” an amount that will rise to $15 million if the company does not pay within 48 hours.
â€” Alex KrÃ¼ger (@krugermacro) July 19, 2020
According to El Tribuno, the ransomware attack, which specifically affected Telecomâ€™s call center, took place on July 18. The ransomware was ultimately contained by the Argentinian conglomerateâ€™s IT workers. In a statement issued to local media outlets, the company elaborated:
“Telecom reports that it managed to contain a cyber attack attempt, of global dispersion, on its platforms. No critical services of the company were affected. It should also be noted that no client of the company was affected by this situation, as well as the bases of company data. Customer service efforts, suspended preventively, will be gradually restored.”
The attack does not seem to have affected services provided by the company such as landlines, mobile phones, or the internet.
An alleged well-known ransomware gang behind the attack
ZDNet quotes sources inside the ISP provider who say that hackers caused â€œextensive damageâ€� to the Telecomâ€™s network. They claim the hackers successfully deployed their ransomware to more than 18,000 workstations across the company.
The report also adds that REvil ransomware gang, or Sodinokibi, could be behind the attack, as the hackers posted a tweet claiming its responsibility by attaching a screenshot of the website, but it was deleted at some point between July 19 and July 20.
But as the hackerâ€™s point of entry was a malicious email attachment sent to one of Telecomâ€™s employees doesnâ€™t fit at all with the tactics used by the gang, as they often deploy the attack via network-based intrusions by targeting vulnerabilities within the IT infrastructure.
Sites hosted in Telecom Argentina are back after the incident
As of press time, most of the official websites belonging to Telecom are now online after a downtime suffered after the attack.
One of the most prominent tweets is an image from a seemingly official company statement in which it acknowledges the attack and lists a series of recommendations for its employees to follow.
â€” GuyWithAMask (@GuyWithAMask4) July 19, 2020
Telecom Argentina didnâ€™t provide further information to the local media outlets about the incident. It is unknown whether they plan to pay the ransom.
REvil said on July 24 that they will auction over 1TB of data stolen from New York-based entertainment law firm, Grubman Shire Meiselas & Sacks. This data allegedly contains the â€œdirtyâ€� secrets of a number of celebrities.
Powered by WPeMatico