Telecom Argentina suffers ransomware attack; told to pay £5.8m to recover files
Leo Daniels • July 23, 2020
This is a subtitle for your new post
Telecom Argentina has been handed a ransom demand of £5.81 million by ransomware hackers who have managed to encrypt up to 18,000 computers using stolen admin credentials.
The ransomware attack targeting IT systems belonging to Telecom Argentina took place on 18th July and involved hackers pasting a ransom note on the telecom giant’s systems, giving the company just three days to pay the ransom to recover its files or risk having the ransom amount doubled.
According to ZDNet, hackers used internal IT admin credentials to gain access to Telecom Argentina’s computers and were successful in installing their ransomware payload into up to 18,000 workstations.
The telecom company has advised employees not to connect to its internal VPN network, not open emails containing archive files, and to limit their interaction with the corporate network.
Telecom Argentina is yet to issue a statement concerning the ransomware attack and it is not clear if a ransom has been paid even though the three-day period given by hackers has expired. No hacker group has taken responsibility for the ransomware attack so far.
Despite impacting thousands of computers connected to the telecom company’s internal server, reports from Argentina have claimed that the ransomware attack has not impacted internet connectivity or any service being provided to millions of Argentinians.
Several reports have also claimed that the hackers found their way in after targeting Telecom Argentina’s employees with phishing emails and obtaining their login credentials. Commenting on this, Tarik Saleh, senior security engineer at DomainTools, said that the majority of spam emails, and clearly the one on which a Telecom employee, unfortunately, click on, have the goal of getting the victim to infect their own computer with malware.
“Soft targeted” email is often the vessel for malicious attachments—for instance, an email may be sent to an HR employee with a .pdf of a job seeker’s resume. In actuality, the resume is an attachment that contains embedded ransomware or malware. In these instances, the infection that this phish brought can now spread from PC to other networked devices—including the cloud,” he added.
Commenting on the successful ransomware attack, Mark Bagley, VP of Product, AttackIQ, said that this is likely to be one of the more expensive ransomware attacks this year and a security programme that included network segmentation, preventing the lateral movement of an adversary would have been decisive in mitigating this situation.
“Legacy approaches that focus on stopping an adversary at their initial attempts to access targets of interest will continue to fail. Companies must design their security programmes to minimise the impact when an adversary successfully infiltrates their network.
“This control of lateral movement is imperative to preventing many other adversary behaviours. Preventing an adversary from using credentials harvested from one system elsewhere in the network – a technique called “credential stuffing” when automated – is one crucial way organisations can reduce the damage of an attack.
“Given the increases in sophistication and automation that have been observed in recent attacks, it’s not enough to address cyber threats as they happen. A proactive cybersecurity approach is vital and should include continuous testing of security posture to identify exposures and improve defences before adversaries apply exploits to them,” he added.
We’re 1-fix, we can help you secure your business
At 1-fix, we take a realistic approach to technology – ensuring our client’s systems are best protected.
If you have any concerns, questions or simply want to explore how to better secure your business, please do get in touch with the team for a FREE demonstration, consultation to explore how exposed your business might be and identify actions to take.
Join Our Mailing List
All sign-ups are handled inline with our privacy policy and can unsubscribe at any time.
Recent Blogs
In a world where AI is changing how we work and compete, security is more important than ever. We are gathering industry leaders and AI experts for a special roundtable event. This event will focus on a key topic: AI security.
Microsoft 365 Business Basic offers a range of cloud-based services designed to empower businesses to work smarter and more efficiently. Let's delve into what this package includes and how it can benefit your organisation.
We’re excited to announce an informative webinar featuring Elliot Wilkie from Brigantia and Craig Atkins from 1-Fix, diving deep into the world of DMARC on 8th July at 2 PM . This is an essential session for anyone looking to secure their email communications, understand DMARC compliance, and enhance their email deliverability.
Businesses are constantly seeking ways to enhance productivity, collaboration, and security, all whilst managing costs effectively. Microsoft Office 365 presents a comprehensive solution that caters to these needs. Here’s a breakdown of the seven key benefits of using Office 365 for your business.
In recent news from Microsoft, there’s significant information affecting charity organisations that rely on Microsoft 365 for their everyday operations. Microsoft has announced that it will be discontinuing the Microsoft 365 Business Premium grant, which currently provides 10 free licenses to nonprofits, with termination slated for March 8, 2026 . Therefore, charities currently benefitting from this grant must prepare for upcoming changes.
Staying efficient and connected has never been more important for businesses. With the increasing demand for remote work solutions and collaborative tools, migrating to Microsoft Office 365 is becoming an essential strategy. In this blog post, we’ll explore the many benefits of Office 365 migration, how 1-Fix can assist you in the process, and how swift and seamless this transition can be.
