IoT chip maker Advantech confirms ransomware attack, data theft
11/30/20 Update below. This post was originally published on November 28th, 2020. It has been updated to reflect Advantech’s confirmation of the attack.
Industrial automation and Industrial IoT (IIoT) chip maker Advantech confirmed a ransomware attack that hit its network and led to the theft of confidential, albeit low-value, company documents.
BleepingComputer was also able to confirm that the Conti ransomware gang was the one that hit the systems of Advantech and is now demanding a $14 million ransom to decrypt affected systems and to stop leaking stolen company data.
Advantech is a global leading manufacturer of IT products and solutions, including embedded PCs, network devices, IoT, servers, and healthcare solutions, with a workforce of over 8,000 people in 92 major cities around the world.
The company was the world industrial computing leader with a 34% WW Market Share in 2018 and it reported a yearly sales revenue of over $1.7 billion in 2019.
Ransom set at 750 Bitcoins
The Conti operators behind the attack on Advantech’s network have set a ransom of 750 BTC (roughly $12,600,000 at today’s exchange rate) for full data decryption and for removing stolen data from their servers according to a chat log seen by BleepingComputer.
Conti also said that they are willing to decrypt two of the encrypted files before the ransom is paid as proof that their decryptor works.
The ransomware operators added on November 21, 2020, that they will leak part of the stolen data if there was no reply from the company within the next day.
On November 26, the group began publishing Advantech’s data on their ransomware data leak site as a 3.03GB archive with 2% of the stolen data and a text document with a list of files included in the ZIP archive.
The ransomware gang also stated that if the ransom is paid they will immediately remove any backdoors deployed on the company’s network and will provide security tips on how to secure the network to block future breaches.
They also said that any stolen data would be deleted once the payment goes through. Despite their promises, research by ransomware negotiation firm Coveware has shown that some ransomware operations don’t actually remove deleted…
