Conti ransomware attack demands $14 million from industrial IoT firm Advantech

• Ransomware encrypts internal network, and data stolen
• 2% of stolen data published by attackers on dark web

The world’s largest maker of industrial computers, Taiwan’s Advantech, has reportedly been hit by a ransomware attack – with cybercriminals demanding a ransom worth approximately US $14 million for a decryption key, and to prevent the public leaking of stolen data.

According to local media reports, Advantech identified earlier this month that its internal network had been compromised by hackers, and although action was taken to stem the spread of the attack it was not enough to prevent the theft of data and the encryption of some databases.

It is claimed that the attackers have demanded a ransomware payment of 750 Bitcoins (worth approximately US $14 million at current exchange rates) from the firm which is a world leader in industrial IoT (IIoT) solutions.

Although Advantech has not confirmed details the type of malware that has locked up its data, it has been suggested that it has fallen victim to the Conti ransomware.

The Conti ransomware is different from some other ransomware attacks, as it is designed to be activated by hackers who have already compromised a computer system, in comparison to attacks launched via a malicious email attachment or download.

Because of this it is possible for an attacker who has been present on a compromised network for some time, gathering information about the company’s infrastructure, to target specific parts of the network for attack, potentially reducing the chances of being spotted in the act, and further frustrating recovery by a company’s IT team.

Bleeping Computer reports that the Conti ransomware gang published an archive of over 3GB of data – said to be just 2% of the total information stolen from Advantech – on the dark web at the end of last week, after the firm failed to give in to the criminals’ ransom demands.

The risk is, of course, that not only will Advantech’s operations be disrupted by the ransomware attack, and sensitive data be leaked into the public domain, but also that its reputation with customers and partners suffer serious damage as a consequence of the data breach.

At the end of October, the US government issued an updated warning about the threat posed by ransomware against the US healthcare industry, specifically calling out the Conti ransomware, and its close cousin Ryuk.

Other recent alleged victims of the Conti ransomware include coffee machine maker De’Longi and customer information firm Ixsight Technologies.