#Apple ransomware fix plus#

A seven-figure ransom might seem appealing if disclosing a breach might result in $2 million of regulatory fines under laws like Europe's GDPR or California's Consumer Privacy Act. But other organizations, especially those that hold regulated personal data from customers, have even more incentive to pay if they think it will help cover up an incident. Just this week, one ransomware group threatened to feed information to short sellers of publicly traded companies.ДЄ company like Apple would presumably take the threat of leaking intellectual property seriously. And attackers have already been experimenting with strategies to put pressure on extortion victims, like contacting individuals or businesses whose data might be impacted by a breach and telling them to encourage a target to pay. Large companies have become a more popular target specifically, because they can potentially afford big payouts it's a more efficient racket for a criminal group than cobbling smaller payments together from more victims. REvil reportedly put the same sum to Acer in March, and the average ransomware demand reportedly doubled between 20. The $50 million demand may seem extraordinary, but it also fits in with the recent ransomware trend of вЂњbig gameвЂќ hunting. Organizations I work with are more likely today to be able to recover and avoid paying a ransom with traditional file-encryption techniques.вЂќ вЂњI can tell you as an incident responder that people have gotten better at responding to ransomware events.

#Apple ransomware fix plus#

вЂњA couple of years ago, we didnвЂ™t really see much ransomware plus extortion at all, and now there's an evolution all the way to extortion-only events,вЂќ says Jake Williams, founder of the cybersecurity firm Rendition Infosec. WeвЂ™re at a point where the threat actors have realized that the data itself can be used in a myriad of ways.вЂќ вЂњIn fact вЂransomware attackвЂ™ is probably something of a misnomer now. вЂњData encryption is becoming less of a part of ransomware attacks for sure,вЂќ says Brett Callow, a threat analyst at the antivirus firm Emsisoft. And groups have even taken it a step further, as is the case with REvil and Quanta, focusing completely on data theft and extortion and not bothering to encrypt files at all. Today incorporating extortion is increasingly the norm. And in the past couple of years, prominent ransomware gangs like Maze have established the approach. Even if victims could recover their affected data from backups, they ran the risk that the attackers would share their secrets with the entire internet. But some attackers also dabbled in another approach-not only did they encrypt the files, but they stole them first and threatened to leak them, adding additional leverage to ensure payment.

вЂњWe recommend that Apple buy back the available data by May 1.вЂќДЇor years, ransomware attacks involved the encryption of a victim's files and a simple transaction: Pay the money, get the decryption key.

вЂњOur team is negotiating the sale of large quantities of confidential drawings and gigabytes of personal data with several major brands,вЂќ REvil wrote in its post of the stolen data. After years of refining their mass data encryption techniques to lock victims out of their own systems, criminal gangs are increasingly focusing on data theft and extortion as the centerpiece of their attacks-and making eye-popping demands in the process. But it also reflects the confluence of a number of disturbing trends in ransomware. The connection to Apple and dramatic timing generated buzz about the attack. They've since added iMac schematics to the pile. As proof, they released a cache of documents about upcoming, unreleased MacBook Pros. The notorious ransomware gang REvil said they had stolen data and schematics from Apple supplier Quanta Computer about unreleased products, and that they would sell the data to the highest bidder if they didnвЂ™t get a $50 million payment. On the day Apple was set to announce a slew of new products at its Spring Loaded event, a leak appeared from an unexpected quarter.