The Black Basta ransomware gang recently added Germany’s Maklersoftware GmbH to its victim list.
Maklersoftware is an independent provider of Application Service Provider (ASP). Details about the amount of data, ransom demanded, or deadline for ransom payment have not been disclosed in the leaked post.
Maklersoftware offers data center solutions to financial and insurance companies and was acquired by Hypoport AG, an online financial service provider, on January 10, 2017.
The Cyber Express has reached out to Hypoport for a confirmation on the breach and is yet to receive a response.
According to researchers, the breach can have occurred by a third-party vendor of Maklersfotware. The discussion on third party cybersecurity has also been brought to the limelight post this incident.
Supply chain attacks can impact the data security of clients it caters to leading to a huge data loss. A single instance of gaining access to a vendor can give away details of dozens of client companies.
Implications of a single supply chain attack
The Equifax supply chain attack (2017) that impacted over 147 million customers, and the Target supply chain attack (2014) on Target USA compromised nearly 40 million debit and credit card details of the users. Both these incidents lead to spiraling cyberattacks stemming from the information stolen from these data breaches.
The average cost arising from various liabilities of a data breach in 2020 was estimated to be around $3.86 million according to a report by IBM and the Ponemon Institute. It also stated that it took over 9 months i.e., nearly 280 days to curb a cyberattack.
Here is a run down on a supply chain attack.
Camouflaging as a security update is one of the easiest ways hackers use to reach several systems and apps. In other cases, hackers tend to send phishing links.
A supply chain attack uses one compromised vendor system to embed the malware and hide under the vendor’s digital signature. This would reduce the risk of validation and detection to a large extent while flaunting the credentials of the host.
The signature would render the malware authentic and allow it to travel across software with it without restrictions. The digital signature of SolarWinds Orion software as shown below was compromised by cybercriminals.
To compromise the systems of SolarWind’s clients, hackers injected a malicious payload in its Dynamic Link Library file (.dll).
In similar instances, while the payload waits in a legitimate file, it gets active and takes command from the hacker’s C2 server often when a patch is made available for a vulnerability or an update is made.
The malicious code runs in the systems of several users in the background while in the foreground the update appears to be from the vendors’ software.
Detecting threats arising from supply chain attacks involves seeing a surplus of spending in the bank account, or a vendor email or call asking for sensitive account data.
It is imperative to not entertain such requests, changing login credentials in accounts as applicable, and doing so only through official apps and websites instead of links provided via communications. Moreover, replacing older bookmarked links with recent ones, as applicable is also good cybersecurity hygiene.
Stay update with all ransomware and data breach news from across the world. Stay subscribed to The Cyber Express.